Overview

overview

10

Static

static

B499D366F0...B7.exe

windows7_x64

10

B499D366F0...B7.exe

windows10_x64

Analysis

  • max time kernel
    139s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    13-06-2021 15:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B499D366F01242597E6386FCBBBACFB7.exe

  • Size

    3.8MB

  • MD5

    b499d366f01242597e6386fcbbbacfb7

  • SHA1

    f4555ab40925523a3183adb353cde2d80aa5fad8

  • SHA256

    b566e04e4dde55640065fa942fcfa35ec3cb5f0c8b6057bfd0039ac4ebbc65f7

  • SHA512

    136fe6b35f1df85f5ea4121a1d3d64f54fbc6d5384ebfa9d69a4dd0c3e1073afd4592b62261080925513d4fa9b71a616d1c8e1e8cedb2a63e39d6b7b14a59401

Score
10/10
redlinesmokeloadervidar706pub57-1aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

PUB57-1

C2

pupdatastart.store:80

pupdata.online:80

Extracted

Family

vidar

Version

39.3

Botnet

706

C2

https://bandakere.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 29 IoCs
  • Modifies registry class 17 IoCs
  • Modifies system certificate store 2 TTPs 19 IoCs
    evasionspywaretrojan
  • Script User-Agent 24 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:856
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2340
    • C:\Users\Admin\AppData\Local\Temp\B499D366F01242597E6386FCBBBACFB7.exe
      "C:\Users\Admin\AppData\Local\Temp\B499D366F01242597E6386FCBBBACFB7.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\setup_install.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c metina_1.exe
          3⤵
          • Loads dropped DLL
          PID:2044
          • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_1.exe
            metina_1.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:432
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im metina_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_1.exe" & del C:\ProgramData\*.dll & exit
              5⤵
                PID:2508
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_2.exe
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2008
            • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_2.exe
              metina_2.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:1504
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_3.exe
            3⤵
            • Loads dropped DLL
            PID:1320
            • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_3.exe
              metina_3.exe
              4⤵
              • Executes dropped EXE
              PID:1484
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_4.exe
            3⤵
            • Loads dropped DLL
            PID:1152
            • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_4.exe
              metina_4.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:556
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_5.exe
            3⤵
            • Loads dropped DLL
            PID:1356
            • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_5.exe
              metina_5.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              PID:1836
              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                PID:2304
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_6.exe
            3⤵
            • Loads dropped DLL
            PID:652
            • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_6.exe
              metina_6.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1428
              • C:\Users\Admin\AppData\Roaming\1496733.exe
                "C:\Users\Admin\AppData\Roaming\1496733.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1696
              • C:\Users\Admin\AppData\Roaming\7882424.exe
                "C:\Users\Admin\AppData\Roaming\7882424.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                PID:1220
                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2084
              • C:\Users\Admin\AppData\Roaming\2507422.exe
                "C:\Users\Admin\AppData\Roaming\2507422.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:2132
                • C:\Users\Admin\AppData\Roaming\2507422.exe
                  "{path}"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1120
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_7.exe
            3⤵
            • Loads dropped DLL
            PID:848
            • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_7.exe
              metina_7.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system certificate store
              PID:592
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_9.exe
            3⤵
            • Loads dropped DLL
            PID:1596
            • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_9.exe
              metina_9.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:1228
              • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_9.exe
                C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_9.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2948
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_8.exe
            3⤵
            • Loads dropped DLL
            PID:1512
      • C:\Users\Admin\AppData\Local\Temp\is-PVRQ2.tmp\metina_4.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-PVRQ2.tmp\metina_4.tmp" /SL5="$70018,189670,105984,C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_4.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1632
        • C:\Users\Admin\AppData\Local\Temp\is-5Q2L7.tmp\(_____(_(_________))235 Smeargle.exe
          "C:\Users\Admin\AppData\Local\Temp\is-5Q2L7.tmp\(_____(_(_________))235 Smeargle.exe" /S /UID=burnerch1
          2⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          PID:1624
          • C:\Program Files\Windows Sidebar\PMQWLQQNCS\ultramediaburner.exe
            "C:\Program Files\Windows Sidebar\PMQWLQQNCS\ultramediaburner.exe" /VERYSILENT
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2488
            • C:\Users\Admin\AppData\Local\Temp\is-MJRC6.tmp\ultramediaburner.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-MJRC6.tmp\ultramediaburner.tmp" /SL5="$4018E,281924,62464,C:\Program Files\Windows Sidebar\PMQWLQQNCS\ultramediaburner.exe" /VERYSILENT
              4⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              PID:2532
              • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                5⤵
                • Executes dropped EXE
                PID:2672
          • C:\Users\Admin\AppData\Local\Temp\0b-32758-306-4c7a6-167fa463d64a7\Cagiwasypu.exe
            "C:\Users\Admin\AppData\Local\Temp\0b-32758-306-4c7a6-167fa463d64a7\Cagiwasypu.exe"
            3⤵
            • Executes dropped EXE
            PID:2556
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
              4⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:2780
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:2
                5⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2844
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275474 /prefetch:2
                5⤵
                • Suspicious use of SetWindowsHookEx
                PID:2648
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1496
                  6⤵
                  • Program crash
                  PID:2312
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:668690 /prefetch:2
                5⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:3048
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:4928523 /prefetch:2
                5⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:3832
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 2108
                  6⤵
                  • Program crash
                  PID:3420
          • C:\Users\Admin\AppData\Local\Temp\52-0d709-5c6-00c83-bce74d2b80e8d\Cujyzhulifu.exe
            "C:\Users\Admin\AppData\Local\Temp\52-0d709-5c6-00c83-bce74d2b80e8d\Cujyzhulifu.exe"
            3⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:2624
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2eyjk04k.kkq\001.exe & exit
              4⤵
                PID:2564
                • C:\Users\Admin\AppData\Local\Temp\2eyjk04k.kkq\001.exe
                  C:\Users\Admin\AppData\Local\Temp\2eyjk04k.kkq\001.exe
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  PID:1868
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2ajzjigj.xrr\GcleanerEU.exe /eufive & exit
                4⤵
                  PID:1484
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iucgni0d.3y2\installer.exe /qn CAMPAIGN="654" & exit
                  4⤵
                    PID:1664
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\52arhohk.sgd\gaoou.exe & exit
                    4⤵
                      PID:1716
                      • C:\Users\Admin\AppData\Local\Temp\52arhohk.sgd\gaoou.exe
                        C:\Users\Admin\AppData\Local\Temp\52arhohk.sgd\gaoou.exe
                        5⤵
                        • Executes dropped EXE
                        • Modifies system certificate store
                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                        PID:2464
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          6⤵
                          • Executes dropped EXE
                          PID:2288
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          6⤵
                          • Executes dropped EXE
                          PID:2504
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\141a1tw3.ggn\Setup3310.exe /Verysilent /subid=623 & exit
                      4⤵
                        PID:2680
                        • C:\Users\Admin\AppData\Local\Temp\141a1tw3.ggn\Setup3310.exe
                          C:\Users\Admin\AppData\Local\Temp\141a1tw3.ggn\Setup3310.exe /Verysilent /subid=623
                          5⤵
                          • Executes dropped EXE
                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                          PID:1576
                          • C:\Users\Admin\AppData\Local\Temp\is-FQ5HA.tmp\Setup3310.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-FQ5HA.tmp\Setup3310.tmp" /SL5="$202C0,138429,56832,C:\Users\Admin\AppData\Local\Temp\141a1tw3.ggn\Setup3310.exe" /Verysilent /subid=623
                            6⤵
                            • Executes dropped EXE
                            • Modifies system certificate store
                            • Suspicious use of FindShellTrayWindow
                            PID:1344
                            • C:\Users\Admin\AppData\Local\Temp\is-SH1SG.tmp\Setup.exe
                              "C:\Users\Admin\AppData\Local\Temp\is-SH1SG.tmp\Setup.exe" /Verysilent
                              7⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:2916
                              • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                8⤵
                                • Executes dropped EXE
                                PID:3024
                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  9⤵
                                  • Executes dropped EXE
                                  PID:1832
                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  9⤵
                                  • Executes dropped EXE
                                  PID:1988
                              • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                8⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                PID:1664
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                  9⤵
                                    PID:1336
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /im RunWW.exe /f
                                      10⤵
                                      • Kills process with taskkill
                                      PID:1640
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 6
                                      10⤵
                                      • Delays execution with timeout.exe
                                      PID:2356
                                • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                  "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                  8⤵
                                  • Executes dropped EXE
                                  PID:2976
                                  • C:\Users\Admin\AppData\Local\Temp\is-QJND8.tmp\lylal220.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-QJND8.tmp\lylal220.tmp" /SL5="$20388,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                    9⤵
                                    • Executes dropped EXE
                                    PID:1936
                                    • C:\Users\Admin\AppData\Local\Temp\is-I9O38.tmp\56FT____________________.exe
                                      "C:\Users\Admin\AppData\Local\Temp\is-I9O38.tmp\56FT____________________.exe" /S /UID=lylal220
                                      10⤵
                                      • Drops file in Drivers directory
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Drops file in Program Files directory
                                      PID:3044
                                      • C:\Program Files\Google\TDSHMTMHTL\irecord.exe
                                        "C:\Program Files\Google\TDSHMTMHTL\irecord.exe" /VERYSILENT
                                        11⤵
                                        • Executes dropped EXE
                                        PID:3488
                                        • C:\Users\Admin\AppData\Local\Temp\is-S6HAT.tmp\irecord.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-S6HAT.tmp\irecord.tmp" /SL5="$204A0,6139911,56832,C:\Program Files\Google\TDSHMTMHTL\irecord.exe" /VERYSILENT
                                          12⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of FindShellTrayWindow
                                          PID:3536
                                          • C:\Program Files (x86)\recording\i-record.exe
                                            "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                            13⤵
                                            • Executes dropped EXE
                                            PID:3720
                                      • C:\Users\Admin\AppData\Local\Temp\0a-06b73-082-5dca2-a9212a08a5d8a\Saecaesukepe.exe
                                        "C:\Users\Admin\AppData\Local\Temp\0a-06b73-082-5dca2-a9212a08a5d8a\Saecaesukepe.exe"
                                        11⤵
                                        • Executes dropped EXE
                                        PID:3688
                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                          "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                          12⤵
                                            PID:3812
                                        • C:\Users\Admin\AppData\Local\Temp\de-d35fc-255-6fd85-e4fc4c6fe364b\Paxaekazhaefy.exe
                                          "C:\Users\Admin\AppData\Local\Temp\de-d35fc-255-6fd85-e4fc4c6fe364b\Paxaekazhaefy.exe"
                                          11⤵
                                            PID:3964
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lf01erkq.3yg\001.exe & exit
                                              12⤵
                                                PID:4044
                                                • C:\Users\Admin\AppData\Local\Temp\lf01erkq.3yg\001.exe
                                                  C:\Users\Admin\AppData\Local\Temp\lf01erkq.3yg\001.exe
                                                  13⤵
                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                  PID:2880
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fer1vkec.m3r\GcleanerEU.exe /eufive & exit
                                                12⤵
                                                  PID:4072
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kh0xekli.icm\installer.exe /qn CAMPAIGN="654" & exit
                                                  12⤵
                                                    PID:3052
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wtmrudud.vwx\gaoou.exe & exit
                                                    12⤵
                                                      PID:3392
                                                      • C:\Users\Admin\AppData\Local\Temp\wtmrudud.vwx\gaoou.exe
                                                        C:\Users\Admin\AppData\Local\Temp\wtmrudud.vwx\gaoou.exe
                                                        13⤵
                                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                        PID:3460
                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          14⤵
                                                            PID:3640
                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                            14⤵
                                                              PID:3076
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\km5pv3ry.rxr\Setup3310.exe /Verysilent /subid=623 & exit
                                                          12⤵
                                                            PID:3856
                                                            • C:\Users\Admin\AppData\Local\Temp\km5pv3ry.rxr\Setup3310.exe
                                                              C:\Users\Admin\AppData\Local\Temp\km5pv3ry.rxr\Setup3310.exe /Verysilent /subid=623
                                                              13⤵
                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                              PID:1636
                                                              • C:\Users\Admin\AppData\Local\Temp\is-VLFG2.tmp\Setup3310.tmp
                                                                "C:\Users\Admin\AppData\Local\Temp\is-VLFG2.tmp\Setup3310.tmp" /SL5="$2050C,138429,56832,C:\Users\Admin\AppData\Local\Temp\km5pv3ry.rxr\Setup3310.exe" /Verysilent /subid=623
                                                                14⤵
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:3796
                                                                • C:\Users\Admin\AppData\Local\Temp\is-DVRJL.tmp\Setup.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-DVRJL.tmp\Setup.exe" /Verysilent
                                                                  15⤵
                                                                  • Drops file in Program Files directory
                                                                  PID:3500
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xc5qi4qq.yyp\google-game.exe & exit
                                                            12⤵
                                                              PID:848
                                                              • C:\Users\Admin\AppData\Local\Temp\xc5qi4qq.yyp\google-game.exe
                                                                C:\Users\Admin\AppData\Local\Temp\xc5qi4qq.yyp\google-game.exe
                                                                13⤵
                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                PID:3096
                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                                                                  14⤵
                                                                    PID:3952
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tv12p1m.lna\005.exe & exit
                                                                12⤵
                                                                  PID:2328
                                                                  • C:\Users\Admin\AppData\Local\Temp\2tv12p1m.lna\005.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2tv12p1m.lna\005.exe
                                                                    13⤵
                                                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                    PID:3472
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rqrem1z5.wpm\GcleanerWW.exe /mixone & exit
                                                                  12⤵
                                                                    PID:592
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j2e3f1xr.ewp\toolspab1.exe & exit
                                                                    12⤵
                                                                      PID:1336
                                                                      • C:\Users\Admin\AppData\Local\Temp\j2e3f1xr.ewp\toolspab1.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\j2e3f1xr.ewp\toolspab1.exe
                                                                        13⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                        PID:1748
                                                                        • C:\Users\Admin\AppData\Local\Temp\j2e3f1xr.ewp\toolspab1.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\j2e3f1xr.ewp\toolspab1.exe
                                                                          14⤵
                                                                          • Suspicious use of SetThreadContext
                                                                          • Checks SCSI registry key(s)
                                                                          • Suspicious behavior: MapViewOfSection
                                                                          PID:3084
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0y4oh3ph.5ba\installer.exe /qn CAMPAIGN="654" & exit
                                                                      12⤵
                                                                        PID:2216
                                                              • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                8⤵
                                                                • Executes dropped EXE
                                                                PID:2160
                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                  9⤵
                                                                  • Modifies registry class
                                                                  PID:2704
                                                              • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                8⤵
                                                                • Executes dropped EXE
                                                                PID:2232
                                                                • C:\Users\Admin\AppData\Local\Temp\is-1G072.tmp\LabPicV3.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-1G072.tmp\LabPicV3.tmp" /SL5="$20378,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                  9⤵
                                                                  • Executes dropped EXE
                                                                  PID:2156
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-350VJ.tmp\_____________.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-350VJ.tmp\_____________.exe" /S /UID=lab214
                                                                    10⤵
                                                                    • Drops file in Drivers directory
                                                                    • Executes dropped EXE
                                                                    PID:2912
                                                                    • C:\Program Files\Microsoft Office\WULZDUTFJP\prolab.exe
                                                                      "C:\Program Files\Microsoft Office\WULZDUTFJP\prolab.exe" /VERYSILENT
                                                                      11⤵
                                                                      • Executes dropped EXE
                                                                      PID:3020
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-VOLPB.tmp\prolab.tmp
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-VOLPB.tmp\prolab.tmp" /SL5="$402DC,575243,216576,C:\Program Files\Microsoft Office\WULZDUTFJP\prolab.exe" /VERYSILENT
                                                                        12⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        PID:2720
                                                                    • C:\Users\Admin\AppData\Local\Temp\e5-05175-376-b60b8-bdfa30ea95606\Ciwolehofi.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\e5-05175-376-b60b8-bdfa30ea95606\Ciwolehofi.exe"
                                                                      11⤵
                                                                      • Executes dropped EXE
                                                                      PID:2240
                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                        12⤵
                                                                          PID:932
                                                                      • C:\Users\Admin\AppData\Local\Temp\1f-04e54-875-3c794-9034e2a97f3a8\Kerushasyju.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1f-04e54-875-3c794-9034e2a97f3a8\Kerushasyju.exe"
                                                                        11⤵
                                                                        • Executes dropped EXE
                                                                        PID:2972
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\adjortfa.u2m\001.exe & exit
                                                                          12⤵
                                                                            PID:2076
                                                                            • C:\Users\Admin\AppData\Local\Temp\adjortfa.u2m\001.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\adjortfa.u2m\001.exe
                                                                              13⤵
                                                                                PID:3012
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ydeigfju.eu4\GcleanerEU.exe /eufive & exit
                                                                              12⤵
                                                                                PID:2504
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\apkdcsgp.ffn\installer.exe /qn CAMPAIGN="654" & exit
                                                                                12⤵
                                                                                  PID:2580
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\twc4cr0m.jpb\gaoou.exe & exit
                                                                                  12⤵
                                                                                    PID:3248
                                                                                    • C:\Users\Admin\AppData\Local\Temp\twc4cr0m.jpb\gaoou.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\twc4cr0m.jpb\gaoou.exe
                                                                                      13⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                      PID:3284
                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                        14⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3420
                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                        14⤵
                                                                                          PID:4076
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fcpnegh1.tad\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                      12⤵
                                                                                        PID:3468
                                                                                        • C:\Users\Admin\AppData\Local\Temp\fcpnegh1.tad\Setup3310.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\fcpnegh1.tad\Setup3310.exe /Verysilent /subid=623
                                                                                          13⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                          PID:3516
                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-81HLT.tmp\Setup3310.tmp
                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-81HLT.tmp\Setup3310.tmp" /SL5="$104A6,138429,56832,C:\Users\Admin\AppData\Local\Temp\fcpnegh1.tad\Setup3310.exe" /Verysilent /subid=623
                                                                                            14⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:3528
                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-4M9T3.tmp\Setup.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-4M9T3.tmp\Setup.exe" /Verysilent
                                                                                              15⤵
                                                                                                PID:3924
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\raov2ocj.xgi\google-game.exe & exit
                                                                                          12⤵
                                                                                            PID:3752
                                                                                            • C:\Users\Admin\AppData\Local\Temp\raov2ocj.xgi\google-game.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\raov2ocj.xgi\google-game.exe
                                                                                              13⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              PID:3792
                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                                                                                                14⤵
                                                                                                • Modifies registry class
                                                                                                PID:3848
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0vaxnhn4.fq4\005.exe & exit
                                                                                            12⤵
                                                                                              PID:3988
                                                                                              • C:\Users\Admin\AppData\Local\Temp\0vaxnhn4.fq4\005.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\0vaxnhn4.fq4\005.exe
                                                                                                13⤵
                                                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                PID:4040
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0igwsiux.3dk\GcleanerWW.exe /mixone & exit
                                                                                              12⤵
                                                                                                PID:3144
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kvvqdswx.ekh\toolspab1.exe & exit
                                                                                                12⤵
                                                                                                  PID:2996
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\kvvqdswx.ekh\toolspab1.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\kvvqdswx.ekh\toolspab1.exe
                                                                                                    13⤵
                                                                                                      PID:3308
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\kvvqdswx.ekh\toolspab1.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\kvvqdswx.ekh\toolspab1.exe
                                                                                                        14⤵
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                        PID:3508
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4yz5fzhi.h1a\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                    12⤵
                                                                                                      PID:3160
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fmlirji0.qlu\google-game.exe & exit
                                                                                      4⤵
                                                                                        PID:2076
                                                                                        • C:\Users\Admin\AppData\Local\Temp\fmlirji0.qlu\google-game.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\fmlirji0.qlu\google-game.exe
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                          PID:2136
                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                                                                                            6⤵
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2200
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\meyxl0ub.jug\005.exe & exit
                                                                                        4⤵
                                                                                          PID:2240
                                                                                          • C:\Users\Admin\AppData\Local\Temp\meyxl0ub.jug\005.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\meyxl0ub.jug\005.exe
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                            PID:2360
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u3lerppt.1kk\GcleanerWW.exe /mixone & exit
                                                                                          4⤵
                                                                                            PID:1592
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iuubrem3.fpb\toolspab1.exe & exit
                                                                                            4⤵
                                                                                              PID:3048
                                                                                              • C:\Users\Admin\AppData\Local\Temp\iuubrem3.fpb\toolspab1.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\iuubrem3.fpb\toolspab1.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                PID:820
                                                                                                • C:\Users\Admin\AppData\Local\Temp\iuubrem3.fpb\toolspab1.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\iuubrem3.fpb\toolspab1.exe
                                                                                                  6⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Checks SCSI registry key(s)
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  PID:556
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u0mihpes.vr1\BrowzarBrowser_J1.exe & exit
                                                                                              4⤵
                                                                                                PID:3036
                                                                                                • C:\Users\Admin\AppData\Local\Temp\u0mihpes.vr1\BrowzarBrowser_J1.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\u0mihpes.vr1\BrowzarBrowser_J1.exe
                                                                                                  5⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                  PID:2700
                                                                                                  • C:\Program Files (x86)\Browzar\lDUMMZ1BpUpA.exe
                                                                                                    "C:\Program Files (x86)\Browzar\lDUMMZ1BpUpA.exe"
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3084
                                                                                                    • C:\Program Files (x86)\Browzar\lDUMMZ1BpUpA.exe
                                                                                                      "C:\Program Files (x86)\Browzar\lDUMMZ1BpUpA.exe"
                                                                                                      7⤵
                                                                                                        PID:4004
                                                                                                    • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                                                      "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks whether UAC is enabled
                                                                                                      • Modifies Internet Explorer settings
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:3128
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v0a0cl2g.kgr\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                  4⤵
                                                                                                    PID:2180
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS493A6F64\metina_8.exe
                                                                                              metina_8.exe
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:1388
                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              PID:916
                                                                                            • C:\Windows\system32\conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe "193749235109978777549648225915010930931212115127-13618286716327478711457398910"
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              PID:3012
                                                                                            • C:\Windows\system32\conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe "-4659333711270561250-977789445-854058632-349918249-22827443604860437-1804353327"
                                                                                              1⤵
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              PID:3308
                                                                                            • C:\Windows\system32\conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe "160617851212170968021409685343-523433835-670401689-1691981750135371858721423622"
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              PID:3952

                                                                                            Network

                                                                                            MITRE ATT&CK Enterprise v6

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • memory/432-195-0x0000000001E60000-0x0000000001EF7000-memory.dmp

                                                                                              Filesize

                                                                                              604KB

                                                                                              Download

                                                                                            • memory/432-197-0x0000000000400000-0x00000000004AF000-memory.dmp

                                                                                              Filesize

                                                                                              700KB

                                                                                              Download

                                                                                            • memory/556-171-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                              Filesize

                                                                                              128KB

                                                                                              Download

                                                                                            • memory/856-305-0x0000000000F30000-0x0000000000FA1000-memory.dmp

                                                                                              Filesize

                                                                                              452KB

                                                                                              Download

                                                                                            • memory/856-303-0x0000000000A50000-0x0000000000A9B000-memory.dmp

                                                                                              Filesize

                                                                                              300KB

                                                                                              Download

                                                                                            • memory/916-60-0x0000000075011000-0x0000000075013000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/1120-261-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1208-229-0x0000000003B40000-0x0000000003B56000-memory.dmp

                                                                                              Filesize

                                                                                              88KB

                                                                                              Download

                                                                                            • memory/1220-207-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1220-211-0x00000000003E0000-0x00000000003EE000-memory.dmp

                                                                                              Filesize

                                                                                              56KB

                                                                                              Download

                                                                                            • memory/1220-209-0x0000000000280000-0x0000000000281000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1220-213-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1228-196-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1228-184-0x00000000000F0000-0x00000000000F1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1228-254-0x0000000000770000-0x0000000000779000-memory.dmp

                                                                                              Filesize

                                                                                              36KB

                                                                                              Download

                                                                                            • memory/1344-280-0x0000000000730000-0x0000000000731000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-275-0x00000000002E0000-0x00000000002E1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-293-0x0000000003880000-0x00000000038D7000-memory.dmp

                                                                                              Filesize

                                                                                              348KB

                                                                                              Download

                                                                                            • memory/1344-288-0x0000000003830000-0x0000000003831000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-287-0x0000000003820000-0x0000000003821000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-286-0x0000000003810000-0x0000000003811000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-291-0x0000000003880000-0x00000000038D7000-memory.dmp

                                                                                              Filesize

                                                                                              348KB

                                                                                              Download

                                                                                            • memory/1344-279-0x0000000000520000-0x0000000000521000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-290-0x0000000003880000-0x00000000038D7000-memory.dmp

                                                                                              Filesize

                                                                                              348KB

                                                                                              Download

                                                                                            • memory/1344-284-0x00000000037F0000-0x00000000037F1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-283-0x00000000021A0000-0x00000000021A1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-285-0x0000000003800000-0x0000000003801000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-289-0x0000000003880000-0x00000000038D7000-memory.dmp

                                                                                              Filesize

                                                                                              348KB

                                                                                              Download

                                                                                            • memory/1344-276-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-278-0x0000000000510000-0x0000000000511000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-277-0x0000000000500000-0x0000000000501000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-281-0x0000000000740000-0x0000000000741000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1344-292-0x0000000003880000-0x00000000038D7000-memory.dmp

                                                                                              Filesize

                                                                                              348KB

                                                                                              Download

                                                                                            • memory/1344-282-0x0000000000750000-0x0000000000751000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1388-190-0x0000000004A71000-0x0000000004A72000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1388-198-0x0000000004A74000-0x0000000004A76000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/1388-187-0x0000000000240000-0x00000000002AE000-memory.dmp

                                                                                              Filesize

                                                                                              440KB

                                                                                              Download

                                                                                            • memory/1388-192-0x0000000004A73000-0x0000000004A74000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1388-189-0x0000000000400000-0x000000000046E000-memory.dmp

                                                                                              Filesize

                                                                                              440KB

                                                                                              Download

                                                                                            • memory/1388-188-0x0000000001E30000-0x0000000001E48000-memory.dmp

                                                                                              Filesize

                                                                                              96KB

                                                                                              Download

                                                                                            • memory/1388-185-0x0000000000340000-0x000000000035A000-memory.dmp

                                                                                              Filesize

                                                                                              104KB

                                                                                              Download

                                                                                            • memory/1388-191-0x0000000004A72000-0x0000000004A73000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1428-155-0x0000000000160000-0x0000000000161000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1428-175-0x0000000000190000-0x00000000001AB000-memory.dmp

                                                                                              Filesize

                                                                                              108KB

                                                                                              Download

                                                                                            • memory/1428-170-0x0000000000140000-0x0000000000141000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1428-181-0x000000001AFB0000-0x000000001AFB2000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/1428-178-0x0000000000150000-0x0000000000151000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1504-194-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                                              Filesize

                                                                                              344KB

                                                                                              Download

                                                                                            • memory/1504-193-0x00000000001E0000-0x00000000001E9000-memory.dmp

                                                                                              Filesize

                                                                                              36KB

                                                                                              Download

                                                                                            • memory/1576-274-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                              Filesize

                                                                                              80KB

                                                                                              Download

                                                                                            • memory/1624-210-0x0000000002130000-0x0000000002132000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/1632-180-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1696-212-0x00000000046E0000-0x00000000046E1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1696-205-0x0000000000350000-0x0000000000361000-memory.dmp

                                                                                              Filesize

                                                                                              68KB

                                                                                              Download

                                                                                            • memory/1696-202-0x00000000003D0000-0x00000000003D1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/1868-264-0x0000000000270000-0x0000000000280000-memory.dmp

                                                                                              Filesize

                                                                                              64KB

                                                                                              Download

                                                                                            • memory/1868-265-0x0000000000290000-0x00000000002A2000-memory.dmp

                                                                                              Filesize

                                                                                              72KB

                                                                                              Download

                                                                                            • memory/1980-89-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                              Filesize

                                                                                              100KB

                                                                                              Download

                                                                                            • memory/1980-125-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                              Filesize

                                                                                              1.5MB

                                                                                              Download

                                                                                            • memory/1980-111-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                              Filesize

                                                                                              100KB

                                                                                              Download

                                                                                            • memory/1980-101-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                              Filesize

                                                                                              100KB

                                                                                              Download

                                                                                            • memory/1980-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                              Filesize

                                                                                              1.5MB

                                                                                              Download

                                                                                            • memory/1980-81-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                              Filesize

                                                                                              572KB

                                                                                              Download

                                                                                            • memory/1980-134-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                              Filesize

                                                                                              152KB

                                                                                              Download

                                                                                            • memory/1980-117-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                              Filesize

                                                                                              572KB

                                                                                              Download

                                                                                            • memory/1980-83-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                              Filesize

                                                                                              152KB

                                                                                              Download

                                                                                            • memory/1980-96-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                              Filesize

                                                                                              100KB

                                                                                              Download

                                                                                            • memory/2084-228-0x0000000002300000-0x0000000002301000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/2084-216-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/2132-221-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/2132-225-0x0000000005190000-0x0000000005191000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/2132-231-0x000000007EF40000-0x000000007EF41000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/2132-230-0x0000000000400000-0x0000000000402000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/2200-302-0x00000000008C0000-0x000000000091C000-memory.dmp

                                                                                              Filesize

                                                                                              368KB

                                                                                              Download

                                                                                            • memory/2200-301-0x0000000002170000-0x0000000002271000-memory.dmp

                                                                                              Filesize

                                                                                              1.0MB

                                                                                              Download

                                                                                            • memory/2360-306-0x0000000000270000-0x0000000000280000-memory.dmp

                                                                                              Filesize

                                                                                              64KB

                                                                                              Download

                                                                                            • memory/2488-234-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                              Filesize

                                                                                              88KB

                                                                                              Download

                                                                                            • memory/2532-243-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/2532-245-0x000000006D891000-0x000000006D893000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/2556-241-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/2624-258-0x0000000000B26000-0x0000000000B45000-memory.dmp

                                                                                              Filesize

                                                                                              124KB

                                                                                              Download

                                                                                            • memory/2624-244-0x0000000000B20000-0x0000000000B22000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/2624-247-0x000007FEF3FC0000-0x000007FEF5056000-memory.dmp

                                                                                              Filesize

                                                                                              16.6MB

                                                                                              Download

                                                                                            • memory/2672-249-0x0000000001F20000-0x0000000001F22000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/2672-248-0x000007FEF3FC0000-0x000007FEF5056000-memory.dmp

                                                                                              Filesize

                                                                                              16.6MB

                                                                                              Download

                                                                                            • memory/2672-257-0x0000000001F26000-0x0000000001F45000-memory.dmp

                                                                                              Filesize

                                                                                              124KB

                                                                                              Download

                                                                                            • memory/2672-259-0x0000000001F45000-0x0000000001F46000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/2780-251-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                              Download

                                                                                            • memory/2948-256-0x0000000004E90000-0x0000000004E91000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download