bd1c01975c2fe3bdea8b2c7de53ccdc12a5fccaae00cbf2ad202a3bf7b905271

Analysis

max time kernel
65s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.Blocker.exe
Size

213KB
MD5

8f87064ff0fa9537bf730c31fc6e5812
SHA1

db42bab1e2520059b1dd5a4fcb506a9b8879d476
SHA256

bd1c01975c2fe3bdea8b2c7de53ccdc12a5fccaae00cbf2ad202a3bf7b905271
SHA512

dc7320c2ab6b55e42bca10f7c033564bcbad78661a217161371c674f5ea0a6229e49e9a8e23802cddb4fc5f752a7d20d25b7cb5095164d686e3cdeb6c544739b
SSDEEP

6144:NfM8H/CEYmoa4VQhnx9KB4uU4sLL3gHovIMToSe:/RYxaGQo4uU4sLL3gLMToSe

Score

10^/10

evasion spyware stealer trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 11 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/504-132-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/504-140-0x0000000000400000-0x00000000004AB000-memory.dmp	upx

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Trojan-Ransom.Win32.Blocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	Trojan-Ransom.Win32.Blocker.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
4972	Process not Found
3164	Process not Found
4312	Process not Found
2152	PING.EXE
3904	PING.EXE
1292	PING.EXE
2412	Process not Found
3256	PING.EXE
3864	Process not Found
4796	Process not Found
1524	Process not Found
4796	PING.EXE
4428	PING.EXE
1560	PING.EXE
4412	PING.EXE
2180	Process not Found
4804	Process not Found
4868	PING.EXE
4996	PING.EXE
2480	PING.EXE
5044	Process not Found
3616	PING.EXE
4684	PING.EXE
2448	Process not Found
3656	Process not Found
1812	PING.EXE
3596	PING.EXE
4336	PING.EXE
3992	PING.EXE
4892	Process not Found
216	Process not Found
4192	Process not Found
2332	Process not Found
3064	Process not Found
2412	Process not Found
5108	Process not Found
2908	PING.EXE
3160	PING.EXE
2016	PING.EXE
4672	Process not Found
2180	PING.EXE
2784	PING.EXE
3740	PING.EXE
2968	PING.EXE
4512	PING.EXE
4784	PING.EXE
2156	Process not Found
1728	Process not Found
1728	Process not Found
2196	Process not Found
4336	PING.EXE
4624	PING.EXE
5064	PING.EXE
2780	PING.EXE
3808	PING.EXE
2376	PING.EXE
4480	Process not Found
3776	Process not Found
2864	Process not Found
3240	PING.EXE
3808	PING.EXE
2156	PING.EXE
5068	PING.EXE
2448	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
4912	WScript.exe
1368	WScript.exe
3644	WScript.exe
3984	WScript.exe
2352	WScript.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 1368	504	Trojan-Ransom.Win32.Blocker.exe	80
PID 504 wrote to memory of 3984	504	Trojan-Ransom.Win32.Blocker.exe	81
PID 504 wrote to memory of 1368	504	Trojan-Ransom.Win32.Blocker.exe	80
PID 504 wrote to memory of 1368	504	Trojan-Ransom.Win32.Blocker.exe	80
PID 504 wrote to memory of 3984	504	Trojan-Ransom.Win32.Blocker.exe	81
PID 504 wrote to memory of 3984	504	Trojan-Ransom.Win32.Blocker.exe	81
PID 504 wrote to memory of 3644	504	Trojan-Ransom.Win32.Blocker.exe	79
PID 504 wrote to memory of 3644	504	Trojan-Ransom.Win32.Blocker.exe	79
PID 504 wrote to memory of 3644	504	Trojan-Ransom.Win32.Blocker.exe	79
PID 504 wrote to memory of 4912	504	Trojan-Ransom.Win32.Blocker.exe	82
PID 504 wrote to memory of 4912	504	Trojan-Ransom.Win32.Blocker.exe	82
PID 504 wrote to memory of 4912	504	Trojan-Ransom.Win32.Blocker.exe	82
PID 504 wrote to memory of 2352	504	Trojan-Ransom.Win32.Blocker.exe	83
PID 504 wrote to memory of 2352	504	Trojan-Ransom.Win32.Blocker.exe	83
PID 504 wrote to memory of 2352	504	Trojan-Ransom.Win32.Blocker.exe	83
PID 3984 wrote to memory of 4640	3984	WScript.exe	85
PID 3984 wrote to memory of 4640	3984	WScript.exe	85
PID 3984 wrote to memory of 4640	3984	WScript.exe	85
PID 2352 wrote to memory of 4916	2352	WScript.exe	89
PID 2352 wrote to memory of 4916	2352	WScript.exe	89
PID 2352 wrote to memory of 4916	2352	WScript.exe	89
PID 1368 wrote to memory of 4792	1368	WScript.exe	88
PID 1368 wrote to memory of 4792	1368	WScript.exe	88
PID 1368 wrote to memory of 4792	1368	WScript.exe	88
PID 3644 wrote to memory of 708	3644	WScript.exe	86
PID 3644 wrote to memory of 708	3644	WScript.exe	86
PID 3644 wrote to memory of 708	3644	WScript.exe	86
PID 4912 wrote to memory of 3320	4912	WScript.exe	87
PID 4912 wrote to memory of 3320	4912	WScript.exe	87
PID 4912 wrote to memory of 3320	4912	WScript.exe	87
PID 3644 wrote to memory of 3172	3644	WScript.exe	95
PID 3644 wrote to memory of 3172	3644	WScript.exe	95
PID 3644 wrote to memory of 3172	3644	WScript.exe	95
PID 1368 wrote to memory of 4196	1368	WScript.exe	162
PID 1368 wrote to memory of 4196	1368	WScript.exe	162
PID 1368 wrote to memory of 4196	1368	WScript.exe	162
PID 2352 wrote to memory of 3584	2352	WScript.exe	98
PID 2352 wrote to memory of 3584	2352	WScript.exe	98
PID 2352 wrote to memory of 3584	2352	WScript.exe	98
PID 4912 wrote to memory of 3620	4912	WScript.exe	99
PID 4912 wrote to memory of 3620	4912	WScript.exe	99
PID 4912 wrote to memory of 3620	4912	WScript.exe	99
PID 3984 wrote to memory of 4596	3984	WScript.exe	100
PID 3984 wrote to memory of 4596	3984	WScript.exe	100
PID 3984 wrote to memory of 4596	3984	WScript.exe	100
PID 3644 wrote to memory of 3280	3644	WScript.exe	165
PID 3644 wrote to memory of 3280	3644	WScript.exe	165
PID 3644 wrote to memory of 3280	3644	WScript.exe	165
PID 4912 wrote to memory of 3740	4912	WScript.exe	107
PID 4912 wrote to memory of 3740	4912	WScript.exe	107
PID 4912 wrote to memory of 3740	4912	WScript.exe	107
PID 2352 wrote to memory of 3556	2352	WScript.exe	211
PID 2352 wrote to memory of 3556	2352	WScript.exe	211
PID 2352 wrote to memory of 3556	2352	WScript.exe	211
PID 3984 wrote to memory of 4560	3984	WScript.exe	109
PID 3984 wrote to memory of 4560	3984	WScript.exe	109
PID 3984 wrote to memory of 4560	3984	WScript.exe	109
PID 1368 wrote to memory of 1812	1368	WScript.exe	171
PID 1368 wrote to memory of 1812	1368	WScript.exe	171
PID 1368 wrote to memory of 1812	1368	WScript.exe	171
PID 3644 wrote to memory of 4464	3644	WScript.exe	232
PID 3644 wrote to memory of 4464	3644	WScript.exe	232
PID 3644 wrote to memory of 4464	3644	WScript.exe	232
PID 3984 wrote to memory of 580	3984	WScript.exe	117

System policy modification 1 TTPs 16 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan-Ransom.Win32.Blocker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:504
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:708
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:328
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4476
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5092
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1364
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5100
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4792
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4980
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:448
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1504
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3596
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3032
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3556
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:448
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3620
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2716
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2156
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:1292
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3992
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:756
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:5064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2648
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:380
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4512
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1160
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2656
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1396
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:708
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3760
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:60
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4164
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1160
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4288
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3196
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2792
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3004
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1308
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4532
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3604
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3084
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2488
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4712
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2016
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1184
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2260
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:936
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4396
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:832
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2660
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1368
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3800
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3744
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2480
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4180
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3876
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3736
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2124
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1772
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3556
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:1812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4528
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3980
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4400
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2440
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2212
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2516
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4336
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:380
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:364
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3056
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1724
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1724
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4560
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4844
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4360
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2204
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1524
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2444
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2908
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4224
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2044
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2480
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3488
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:932
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2012
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4472
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1844
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3808
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4464
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3432
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4288
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4472
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:444
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3128
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2164
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4344
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4212
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5080
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1160
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4888
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1876
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3984
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:580
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3240
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2124
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3800
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2152
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5060
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4868
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5068
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4412
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3216
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3944
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:740
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:380
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:524
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4796
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3724
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3320
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4104
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4328
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:864
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5092
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4624
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2448
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1292
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4900
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4428
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5052
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:5068
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2648
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1244
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2180
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2580
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4580
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3920
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4232
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1292
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1404
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3616
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:580
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4276
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3500
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3724
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1596
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4296
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2420
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:364
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4412
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3856
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4360
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4368
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1200
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1664
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4928
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4040
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2480
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2344
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:840
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3740
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4868
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1632
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:524
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3904
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4428
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2180
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4884
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2656
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3168
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2420
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3836
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3808
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4060
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:756
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4948
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3360
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3568
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4112
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:860
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2344
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3056
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1324
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1372
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3584
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3916
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3744
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1632
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1360
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3944
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1140
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5000
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3160
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3740
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3424
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4328
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:580
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2800
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3280
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4496
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4336
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3316
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5108
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1880
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1752
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5068
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1372
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2568
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4260
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:2376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1988
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:448
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5104
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3808
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3864
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2908
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:60
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3496
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\appdata\Roaming\WinNTService.vbs"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2352
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4212
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3836
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4464
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4804
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2152
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4984
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4224
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4948
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4176
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1160
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:432
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4484
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4368
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:756
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1752
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4756
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3104
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:448
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:4336
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:1560
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1788
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2796
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4156
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1624
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5052
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4728
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1148
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1320
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2136
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4404
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:908
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:684
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:840
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2260
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4476
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5024
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4368
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4384
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1852
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5076
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4288
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3004
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4540
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5064
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4688
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2668
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4596
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:996
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:840
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1812
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4620
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4356
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1988
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3992
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:860
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:216
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:792
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1360
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3620
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1200
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:380
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:932
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3448
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2388
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1380
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4192
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2480
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:528
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2280
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2836
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    - Runs ping.exe
    PID:3256
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" -n 1 update.hotdogsystem.com
    3⤵
    PID:4112

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv rsjod0VR+kyBDDXNQlWjNg.0.2
1⤵
PID:4476

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4804

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4344

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
C:\Users\Admin\appdata\Roaming\WinNTService.vbs

Filesize
14KB

MD5
4cbb9dd1d4f2b89c8d2490496edf41af

SHA1
4adbb0912d681bc9661b3b8f6d199ddd822dda8a

SHA256
1da21d7904afc28d125ce63f5eeb5f19b4c59966658eb641d3e765a25c8f929c

SHA512
1b18cca180c90737a57fa7b2766e64a7beb23b8fbc4df372cd9ccf5a5c79c0a3c0a2031f2c2844fa82430f7b967fdcc81311e3e87bcd70b7035c685435bb024e

Download Submit
memory/504-132-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/504-140-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads