Overview

overview

10

Static

static

D0CD0B55D6...0F.exe

windows7_x64

10

D0CD0B55D6...0F.exe

windows10_x64

Analysis

  • max time kernel
    29s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-06-2021 17:56

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    D0CD0B55D658B5C1109F87AF54CF7A0F.exe

  • Size

    3.9MB

  • MD5

    d0cd0b55d658b5c1109f87af54cf7a0f

  • SHA1

    6c7e977a1096c9fa4fb3e5e45a5009b42a23fd4d

  • SHA256

    2507f070a5e9c57e22b5c3ce3b54fade48f9aba2d444fa7d0c48146a94309e06

  • SHA512

    de8c8a3abb4d1484da6dbea9d628a6b99f889bab8852ba14f71cb1c952433ec197cdd6c88faa580dc688227749f3faaebed171523bf369e9b68001f82b34abe1

Score
10/10
gluptebametasploitplugxredlinesmokeloadervidaraspackv2backdoordiscoverydropperinfostealerloaderpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 1 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 25 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 15 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2664
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2980
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2688
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2568
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2548
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1816
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1380
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1352
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1188
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1128
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:1068
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:296
                        • C:\Users\Admin\AppData\Local\Temp\D0CD0B55D658B5C1109F87AF54CF7A0F.exe
                          "C:\Users\Admin\AppData\Local\Temp\D0CD0B55D658B5C1109F87AF54CF7A0F.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:912
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3044
                            • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:644
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c metina_1.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3392
                                • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_1.exe
                                  metina_1.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Modifies registry class
                                  PID:3424
                                  • C:\Windows\SysWOW64\rUNdlL32.eXe
                                    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                    6⤵
                                    • Loads dropped DLL
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3652
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c metina_2.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2124
                                • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_2.exe
                                  metina_2.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: MapViewOfSection
                                  PID:3936
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c metina_3.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2236
                                • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_3.exe
                                  metina_3.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1972
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im metina_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_3.exe" & del C:\ProgramData\*.dll & exit
                                    6⤵
                                      PID:3536
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im metina_3.exe /f
                                        7⤵
                                        • Kills process with taskkill
                                        PID:5336
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        7⤵
                                        • Delays execution with timeout.exe
                                        PID:6048
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_4.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2192
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_4.exe
                                    metina_4.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of WriteProcessMemory
                                    PID:3852
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      6⤵
                                      • Executes dropped EXE
                                      PID:2244
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1600
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_5.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2144
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_5.exe
                                    metina_5.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1900
                                    • C:\Users\Admin\AppData\Local\Temp\is-AS5IJ.tmp\metina_5.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\is-AS5IJ.tmp\metina_5.tmp" /SL5="$4002E,176358,92672,C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_5.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:3172
                                      • C:\Users\Admin\AppData\Local\Temp\is-TTG7J.tmp\67________F.exe
                                        "C:\Users\Admin\AppData\Local\Temp\is-TTG7J.tmp\67________F.exe" /S /UID=burnerch1
                                        7⤵
                                        • Drops file in Drivers directory
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Drops file in Program Files directory
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4220
                                        • C:\Program Files\Mozilla Firefox\CYNTDALJVH\ultramediaburner.exe
                                          "C:\Program Files\Mozilla Firefox\CYNTDALJVH\ultramediaburner.exe" /VERYSILENT
                                          8⤵
                                          • Executes dropped EXE
                                          PID:4316
                                          • C:\Users\Admin\AppData\Local\Temp\is-K1J05.tmp\ultramediaburner.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\is-K1J05.tmp\ultramediaburner.tmp" /SL5="$501DE,281924,62464,C:\Program Files\Mozilla Firefox\CYNTDALJVH\ultramediaburner.exe" /VERYSILENT
                                            9⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            PID:4940
                                            • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                              "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                              10⤵
                                              • Executes dropped EXE
                                              PID:4868
                                        • C:\Users\Admin\AppData\Local\Temp\8b-02456-412-f99aa-dcd04ff8f8622\Jovyjediqae.exe
                                          "C:\Users\Admin\AppData\Local\Temp\8b-02456-412-f99aa-dcd04ff8f8622\Jovyjediqae.exe"
                                          8⤵
                                          • Executes dropped EXE
                                          PID:4948
                                        • C:\Users\Admin\AppData\Local\Temp\58-f8121-e29-b91b0-b4ee98e31471b\Nelubedele.exe
                                          "C:\Users\Admin\AppData\Local\Temp\58-f8121-e29-b91b0-b4ee98e31471b\Nelubedele.exe"
                                          8⤵
                                          • Executes dropped EXE
                                          PID:5072
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mfcbwfbr.j0h\Cube_EU.exe & exit
                                            9⤵
                                              PID:4832
                                              • C:\Users\Admin\AppData\Local\Temp\mfcbwfbr.j0h\Cube_EU.exe
                                                C:\Users\Admin\AppData\Local\Temp\mfcbwfbr.j0h\Cube_EU.exe
                                                10⤵
                                                  PID:5648
                                                  • C:\Users\Admin\AppData\Local\Temp\VCBuilds\PL_Tracker.exe
                                                    C:\Users\Admin\AppData\Local\Temp\VCBuilds\PL_Tracker.exe
                                                    11⤵
                                                      PID:5460
                                                    • C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe
                                                      C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe
                                                      11⤵
                                                        PID:5796
                                                        • C:\Users\Admin\AppData\Local\Temp\is-ES5IM.tmp\setup.tmp
                                                          "C:\Users\Admin\AppData\Local\Temp\is-ES5IM.tmp\setup.tmp" /SL5="$2031A,1729489,56832,C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe"
                                                          12⤵
                                                            PID:5972
                                                            • C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe" /SILENT
                                                              13⤵
                                                                PID:5176
                                                                • C:\Users\Admin\AppData\Local\Temp\is-O3FTH.tmp\setup.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-O3FTH.tmp\setup.tmp" /SL5="$2036A,1729489,56832,C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe" /SILENT
                                                                  14⤵
                                                                    PID:5044
                                                                    • C:\Program Files (x86)\viewerise\WeriseTweaker.exe
                                                                      "C:\Program Files (x86)\viewerise\WeriseTweaker.exe" ss1
                                                                      15⤵
                                                                        PID:4144
                                                                      • C:\Program Files (x86)\viewerise\NDP472-KB4054531-Web.exe
                                                                        "C:\Program Files (x86)\viewerise\NDP472-KB4054531-Web.exe" /q /norestart
                                                                        15⤵
                                                                          PID:508
                                                                          • C:\12fa275bd14f2529b4b332\Setup.exe
                                                                            C:\12fa275bd14f2529b4b332\\Setup.exe /q /norestart /x86 /x64 /web
                                                                            16⤵
                                                                              PID:5732
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-TRC71.tmp\winhost.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-TRC71.tmp\winhost.exe" ss1
                                                                            15⤵
                                                                              PID:5648
                                                                              • C:\Users\Admin\AppData\Local\Temp\hL9kJjYNN.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\hL9kJjYNN.exe"
                                                                                16⤵
                                                                                  PID:4788
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t4bao55z.5du\001.exe & exit
                                                                    9⤵
                                                                      PID:5452
                                                                      • C:\Users\Admin\AppData\Local\Temp\t4bao55z.5du\001.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\t4bao55z.5du\001.exe
                                                                        10⤵
                                                                          PID:5628
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ffya1tve.toj\GcleanerEU.exe /eufive & exit
                                                                        9⤵
                                                                          PID:5820
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\who0c2k3.vqj\installer.exe /qn CAMPAIGN="654" & exit
                                                                          9⤵
                                                                            PID:5188
                                                                            • C:\Users\Admin\AppData\Local\Temp\who0c2k3.vqj\installer.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\who0c2k3.vqj\installer.exe /qn CAMPAIGN="654"
                                                                              10⤵
                                                                                PID:4812
                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\who0c2k3.vqj\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\who0c2k3.vqj\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1623009060 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                  11⤵
                                                                                    PID:6104
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\52lq5rfw.sa4\ebook.exe & exit
                                                                                9⤵
                                                                                  PID:5240
                                                                                  • C:\Users\Admin\AppData\Local\Temp\52lq5rfw.sa4\ebook.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\52lq5rfw.sa4\ebook.exe
                                                                                    10⤵
                                                                                      PID:5704
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\52lq5rfw.sa4\EBOOKE~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\52lq5rfw.sa4\ebook.exe
                                                                                        11⤵
                                                                                          PID:6072
                                                                                          • C:\Windows\SysWOW64\RUNDLL32.EXE
                                                                                            C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\52lq5rfw.sa4\EBOOKE~1.DLL,FwgPLDaABVz8
                                                                                            12⤵
                                                                                              PID:5224
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpAFB9.tmp.ps1"
                                                                                                13⤵
                                                                                                  PID:2272
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rwfc0gyn.vmw\md1_1eaf.exe & exit
                                                                                          9⤵
                                                                                            PID:5844
                                                                                            • C:\Users\Admin\AppData\Local\Temp\rwfc0gyn.vmw\md1_1eaf.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\rwfc0gyn.vmw\md1_1eaf.exe
                                                                                              10⤵
                                                                                                PID:6132
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\10qw4uce.lbw\gaoou.exe & exit
                                                                                              9⤵
                                                                                                PID:1664
                                                                                                • C:\Users\Admin\AppData\Local\Temp\10qw4uce.lbw\gaoou.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\10qw4uce.lbw\gaoou.exe
                                                                                                  10⤵
                                                                                                    PID:6008
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                      11⤵
                                                                                                        PID:5176
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                        11⤵
                                                                                                          PID:5848
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y4bd0coi.nlo\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                      9⤵
                                                                                                        PID:5312
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\y4bd0coi.nlo\Setup3310.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\y4bd0coi.nlo\Setup3310.exe /Verysilent /subid=623
                                                                                                          10⤵
                                                                                                            PID:3536
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-TTBUK.tmp\Setup3310.tmp
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-TTBUK.tmp\Setup3310.tmp" /SL5="$3029E,138429,56832,C:\Users\Admin\AppData\Local\Temp\y4bd0coi.nlo\Setup3310.exe" /Verysilent /subid=623
                                                                                                              11⤵
                                                                                                                PID:764
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-0N5VB.tmp\Setup.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-0N5VB.tmp\Setup.exe" /Verysilent
                                                                                                                  12⤵
                                                                                                                    PID:5508
                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe
                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe"
                                                                                                                      13⤵
                                                                                                                        PID:5484
                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe
                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe"
                                                                                                                          14⤵
                                                                                                                            PID:4720
                                                                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe
                                                                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe"
                                                                                                                            14⤵
                                                                                                                              PID:5952
                                                                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                            13⤵
                                                                                                                              PID:4688
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                14⤵
                                                                                                                                  PID:2560
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                  14⤵
                                                                                                                                    PID:4432
                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                  13⤵
                                                                                                                                    PID:1516
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-U4L27.tmp\lylal220.tmp
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-U4L27.tmp\lylal220.tmp" /SL5="$30438,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                      14⤵
                                                                                                                                        PID:4328
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-026AQ.tmp\56FT____________________.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-026AQ.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                                                                          15⤵
                                                                                                                                            PID:5964
                                                                                                                                            • C:\Program Files\Windows Multimedia Platform\FJNKIANOHP\irecord.exe
                                                                                                                                              "C:\Program Files\Windows Multimedia Platform\FJNKIANOHP\irecord.exe" /VERYSILENT
                                                                                                                                              16⤵
                                                                                                                                                PID:5508
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-BELQ8.tmp\irecord.tmp
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-BELQ8.tmp\irecord.tmp" /SL5="$5043A,6139911,56832,C:\Program Files\Windows Multimedia Platform\FJNKIANOHP\irecord.exe" /VERYSILENT
                                                                                                                                                  17⤵
                                                                                                                                                    PID:2852
                                                                                                                                                    • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                      "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                      18⤵
                                                                                                                                                        PID:6128
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6c-1c306-e96-0ebad-4b1c3b67e63dd\Sejebaesyqo.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6c-1c306-e96-0ebad-4b1c3b67e63dd\Sejebaesyqo.exe"
                                                                                                                                                    16⤵
                                                                                                                                                      PID:1372
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\54-75656-ec6-fb088-432eca54414c1\Laepupishawe.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\54-75656-ec6-fb088-432eca54414c1\Laepupishawe.exe"
                                                                                                                                                      16⤵
                                                                                                                                                        PID:3848
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vjzbe2ww.hay\001.exe & exit
                                                                                                                                                          17⤵
                                                                                                                                                            PID:11328
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vjzbe2ww.hay\001.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\vjzbe2ww.hay\001.exe
                                                                                                                                                              18⤵
                                                                                                                                                                PID:11832
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hazshjpi.2gz\GcleanerEU.exe /eufive & exit
                                                                                                                                                              17⤵
                                                                                                                                                                PID:11596
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\idq25g0y.ytg\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                17⤵
                                                                                                                                                                  PID:11816
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\idq25g0y.ytg\installer.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\idq25g0y.ytg\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                    18⤵
                                                                                                                                                                      PID:12252
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f03bvepk.cmu\gaoou.exe & exit
                                                                                                                                                                    17⤵
                                                                                                                                                                      PID:12136
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f03bvepk.cmu\gaoou.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\f03bvepk.cmu\gaoou.exe
                                                                                                                                                                        18⤵
                                                                                                                                                                          PID:5972
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                            19⤵
                                                                                                                                                                              PID:11664
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                              19⤵
                                                                                                                                                                                PID:6516
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ynlqd0ph.set\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                            17⤵
                                                                                                                                                                              PID:4492
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ynlqd0ph.set\Setup3310.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\ynlqd0ph.set\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                18⤵
                                                                                                                                                                                  PID:3156
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-SROSL.tmp\Setup3310.tmp
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-SROSL.tmp\Setup3310.tmp" /SL5="$4043E,138429,56832,C:\Users\Admin\AppData\Local\Temp\ynlqd0ph.set\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                    19⤵
                                                                                                                                                                                      PID:12268
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yb0i3jqb.gzp\google-game.exe & exit
                                                                                                                                                                                  17⤵
                                                                                                                                                                                    PID:11836
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yb0i3jqb.gzp\google-game.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yb0i3jqb.gzp\google-game.exe
                                                                                                                                                                                      18⤵
                                                                                                                                                                                        PID:4692
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s0kmi32k.ey3\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                      17⤵
                                                                                                                                                                                        PID:4204
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cy2xqrps.4qi\005.exe & exit
                                                                                                                                                                                        17⤵
                                                                                                                                                                                          PID:6268
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cy2xqrps.4qi\005.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\cy2xqrps.4qi\005.exe
                                                                                                                                                                                            18⤵
                                                                                                                                                                                              PID:7152
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d340knlv.lm4\toolspab1.exe & exit
                                                                                                                                                                                            17⤵
                                                                                                                                                                                              PID:7224
                                                                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                      13⤵
                                                                                                                                                                                        PID:4204
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-T8P20.tmp\LabPicV3.tmp
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-T8P20.tmp\LabPicV3.tmp" /SL5="$3043A,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                          14⤵
                                                                                                                                                                                            PID:4672
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-F466J.tmp\_____________.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-F466J.tmp\_____________.exe" /S /UID=lab214
                                                                                                                                                                                              15⤵
                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                • C:\Program Files\Windows Defender\RGEXKCKVYK\prolab.exe
                                                                                                                                                                                                  "C:\Program Files\Windows Defender\RGEXKCKVYK\prolab.exe" /VERYSILENT
                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                    PID:616
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-JCD34.tmp\prolab.tmp
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-JCD34.tmp\prolab.tmp" /SL5="$8030A,575243,216576,C:\Program Files\Windows Defender\RGEXKCKVYK\prolab.exe" /VERYSILENT
                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8e-8aac8-571-2acbf-af17e17e4d921\Boshabaejaepo.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8e-8aac8-571-2acbf-af17e17e4d921\Boshabaejaepo.exe"
                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0d-046e4-112-90d8f-b604c38eae85e\Verafyruwae.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0d-046e4-112-90d8f-b604c38eae85e\Verafyruwae.exe"
                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dh42yty1.q2s\001.exe & exit
                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                              PID:6508
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dh42yty1.q2s\001.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\dh42yty1.q2s\001.exe
                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                  PID:5772
                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fkbns5lo.vl2\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xkxffozd.d2z\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                    PID:11224
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\xkxffozd.d2z\installer.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\xkxffozd.d2z\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                        PID:11780
                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bqtvnurt.pgj\gaoou.exe & exit
                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                        PID:11568
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bqtvnurt.pgj\gaoou.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\bqtvnurt.pgj\gaoou.exe
                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                            PID:11992
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                PID:11432
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                  PID:7012
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rq20etcj.n4w\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                PID:12072
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\rq20etcj.n4w\Setup3310.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\rq20etcj.n4w\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-BF679.tmp\Setup3310.tmp
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-BF679.tmp\Setup3310.tmp" /SL5="$60310,138429,56832,C:\Users\Admin\AppData\Local\Temp\rq20etcj.n4w\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                                                        PID:5668
                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zsleqvy5.bw3\google-game.exe & exit
                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                      PID:6152
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\zsleqvy5.bw3\google-game.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\zsleqvy5.bw3\google-game.exe
                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                          PID:11760
                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ihpklpa1.niv\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                          PID:12048
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uaoqaajw.bya\005.exe & exit
                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                            PID:11552
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\uaoqaajw.bya\005.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\uaoqaajw.bya\005.exe
                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                PID:4964
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ludq01o2.rb2\toolspab1.exe & exit
                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                PID:7136
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ludq01o2.rb2\toolspab1.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ludq01o2.rb2\toolspab1.exe
                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                            PID:2580
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                PID:1172
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                PID:1228
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                      taskkill /im RunWW.exe /f
                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                      PID:4300
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                      timeout /t 6
                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                      PID:5852
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3u50juki.vth\google-game.exe & exit
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                            PID:4192
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3u50juki.vth\google-game.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3u50juki.vth\google-game.exe
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                PID:5024
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\34woe5ip.ksc\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                  PID:5488
                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\db1ngifk.sn2\005.exe & exit
                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                    PID:5508
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db1ngifk.sn2\005.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\db1ngifk.sn2\005.exe
                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3rbqfyn4.2zq\toolspab1.exe & exit
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                        PID:5556
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3rbqfyn4.2zq\toolspab1.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3rbqfyn4.2zq\toolspab1.exe
                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                            PID:5432
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3rbqfyn4.2zq\toolspab1.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3rbqfyn4.2zq\toolspab1.exe
                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                PID:6120
                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0s31e4e0.jmu\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                              PID:6272
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0s31e4e0.jmu\installer.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\0s31e4e0.jmu\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                  PID:6672
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tt32dimp.vwm\702564a0.exe & exit
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                  PID:6596
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tt32dimp.vwm\702564a0.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\tt32dimp.vwm\702564a0.exe
                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ezwi3gjm.ayb\app.exe /8-2222 & exit
                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                      PID:11472
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ezwi3gjm.ayb\app.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\ezwi3gjm.ayb\app.exe /8-2222
                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                          PID:11948
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c metina_6.exe
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:3156
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_6.exe
                                                                                                                                                                                                                                                                metina_6.exe
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\6451588.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\6451588.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\3887121.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\3887121.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\4419194.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\4419194.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:4400
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\4419194.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\4419194.exe"
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c metina_7.exe
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:60
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_7.exe
                                                                                                                                                                                                                                                                  metina_7.exe
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:912
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C powershell Add-MpPreference -ExclusionExtension .exe -Force
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        powershell Add-MpPreference -ExclusionExtension .exe -Force
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\QNAZCF6TEM9ZYWCHAE5J5VSZ.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:4648
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\QNAZCF6TEM9ZYWCHAE5J5VSZ.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\QNAZCF6TEM9ZYWCHAE5J5VSZ.exe"
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4840
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\QNAZCF6TEM9ZYWCHAE5J5VSZ.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\QNAZCF6TEM9ZYWCHAE5J5VSZ.exe"
                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                              PID:5292
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\IS8IJL581YXONZWKLAG2ZS1P.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\IS8IJL581YXONZWKLAG2ZS1P.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\IS8IJL581YXONZWKLAG2ZS1P.exe"
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4816
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\05683424048.exe"
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                  PID:5384
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\05683424048.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\05683424048.exe"
                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                      PID:5672
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\40271522675.exe" /mix
                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                      PID:5740
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\40271522675.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\40271522675.exe" /mix
                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\93450868504.exe" /mix
                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                          PID:5808
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\93450868504.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\{ld9M-jzlnB-VUhh-if5D8}\93450868504.exe" /mix
                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                              PID:5180
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exe
                                                                                                                                                                                                                                                                                                edspolishpp.exe
                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im "IS8IJL581YXONZWKLAG2ZS1P.exe" /f & erase "C:\Users\Admin\AppData\Roaming\IS8IJL581YXONZWKLAG2ZS1P.exe" & exit
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                PID:512
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /im "IS8IJL581YXONZWKLAG2ZS1P.exe" /f
                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "metina_7.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_7.exe" & exit
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:5216
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                taskkill /im "metina_7.exe" /f
                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c metina_8.exe
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                          PID:2256
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4EB10B94\metina_8.exe
                                                                                                                                                                                                                                                                                            metina_8.exe
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:2264
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c metina_9.exe
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:2716
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c metina_10.exe
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:1012
                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                        PID:1148
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:4160
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:1216
                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:5144
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:5472
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 976E0FC5E8E90B1F9EB80628F8E583E0 C
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:5272
                                                                                                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 4BD22634307AA1D76689F08B4BDF7FB6
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:4240
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                      PID:5644
                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding A27688E191B2A271AFC8D474A6B6849A E Global\MSI0000
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:11312
                                                                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:5444
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3247.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3247.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:6292
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4E9A.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\4E9A.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:11348
                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:4528
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:6420

                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                              • memory/296-223-0x0000021EE4F00000-0x0000021EE4F70000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/644-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/644-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/644-133-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                152KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/644-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/644-135-0x0000000000400000-0x000000000051D000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/644-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/644-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                572KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/644-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/912-181-0x0000000000C10000-0x0000000000C11000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/912-243-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1068-259-0x000002B51B300000-0x000002B51B370000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1128-251-0x000001A2FFB80000-0x000001A2FFBF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1148-252-0x000002A5B1E20000-0x000002A5B1E90000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1188-278-0x000001EF8E2D0000-0x000001EF8E340000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1216-320-0x000001B38E670000-0x000001B38E6BB000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1216-321-0x000001B38E830000-0x000001B38E8A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1352-266-0x000002251BE80000-0x000002251BEF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1380-286-0x000001BFD3390000-0x000001BFD3400000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1816-273-0x00000203EAFB0000-0x00000203EB020000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1900-173-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                116KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1972-302-0x0000000002130000-0x00000000021C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                604KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/1972-306-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                664KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2264-177-0x0000000000400000-0x00000000005DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2548-233-0x000001DD252B0000-0x000001DD25320000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2568-244-0x0000019C1D340000-0x0000019C1D3B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2568-239-0x0000019C1C780000-0x0000019C1C7CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2664-298-0x0000025CEB100000-0x0000025CEB170000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2688-300-0x0000026C17740000-0x0000026C177B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2980-272-0x0000016C15480000-0x0000016C154F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3052-325-0x00000000003C0000-0x00000000003D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3172-188-0x0000000000550000-0x0000000000551000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3184-183-0x000000001AE40000-0x000000001AE42000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3184-180-0x0000000000820000-0x000000000083B000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                108KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3184-174-0x0000000000110000-0x0000000000111000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3204-197-0x0000000000560000-0x0000000000561000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3204-258-0x0000000004E70000-0x0000000004E71000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3204-231-0x0000000004DF0000-0x0000000004E19000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                164KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3652-218-0x0000000004CBD000-0x0000000004DBE000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3652-229-0x0000000004DC0000-0x0000000004E1C000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                368KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3936-304-0x0000000000400000-0x000000000044D000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                308KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/3936-303-0x0000000000630000-0x0000000000639000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-283-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-322-0x000000007EEA0000-0x000000007EEA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-291-0x0000000007710000-0x0000000007711000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-323-0x0000000000FC3000-0x0000000000FC4000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-289-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-279-0x0000000006E50000-0x0000000006E51000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-292-0x00000000077A0000-0x00000000077A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-230-0x0000000000F80000-0x0000000000F81000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-235-0x0000000006F70000-0x0000000006F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4104-236-0x0000000000FC2000-0x0000000000FC3000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4160-221-0x000001AF5A630000-0x000001AF5A6A0000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4168-242-0x0000000000830000-0x000000000083E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                56KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4168-217-0x00000000000D0000-0x00000000000D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4168-260-0x00000000008C0000-0x00000000008C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4168-245-0x0000000009320000-0x0000000009321000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4168-232-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4220-225-0x00000000029F0000-0x00000000029F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4288-301-0x0000000005180000-0x0000000005181000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4316-336-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4400-241-0x00000000055A0000-0x00000000055A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4400-287-0x0000000008CE0000-0x0000000008D59000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                484KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4400-265-0x0000000005660000-0x0000000005661000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4400-262-0x00000000057E0000-0x00000000057E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4400-267-0x00000000058B0000-0x00000000058B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4400-293-0x0000000005930000-0x000000000594E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4400-253-0x00000000056E0000-0x00000000056E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4400-234-0x0000000000C80000-0x0000000000C81000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4816-347-0x00000000004C0000-0x000000000060A000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4840-346-0x0000000002E70000-0x000000000377C000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                9.0MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4868-341-0x00000000027B0000-0x00000000027B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4868-343-0x00000000027B2000-0x00000000027B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4868-345-0x00000000027B5000-0x00000000027B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4868-344-0x00000000027B4000-0x00000000027B5000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4940-338-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/4948-337-0x0000000002B50000-0x0000000002B52000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/5072-339-0x0000000000E60000-0x0000000000E62000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/5072-342-0x0000000000E62000-0x0000000000E64000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download