Overview

overview

10

Static

static

af94791370...76.exe

windows7_x64

10

af94791370...76.exe

windows10_x64

10

Analysis

  • max time kernel
    36s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    15/06/2021, 08:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    af94791370afdf086955666671dd2476.exe
  • Size 4.0MB
  • Sample210615-hdbfapkvse
  • SHA256 c7dac0da25d58206459be8af996568547c3df0f76149c741e607249af4c47a67
  • MD5 SHA1 SHA512
Score
10/10
redlinesmokeloadervidar706agilenetaspackv2backdoordiscoveryinfostealerpersistencestealertrojanupx

Malware Config

Extracted

Family

  • vidar

Version

  • 39.3

Botnet

  • 706

C2

  • https://bandakere.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://ppcspb.com/upload/

  • http://mebbing.com/upload/

  • http://twcamel.com/upload/

  • http://howdycash.com/upload/

  • http://lahuertasonora.com/upload/

  • http://kpotiques.com/upload/

rc4.i32
rc4.i32

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 46 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 6 IoCs
    evasion
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 15 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:1044
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s UserManager
      1⤵
        PID:1296
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2716
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
            PID:2700
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Browser
            1⤵
              PID:2604
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2388
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2368
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1836
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                  1⤵
                    PID:1380
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1228
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1092
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:60
                        • C:\Users\Admin\AppData\Local\Temp\af94791370afdf086955666671dd2476.exe
                          "C:\Users\Admin\AppData\Local\Temp\af94791370afdf086955666671dd2476.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:656
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3876
                            • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:3356
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c metina_1.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2212
                                • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_1.exe
                                  metina_1.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3884
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im metina_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_1.exe" & del C:\ProgramData\*.dll & exit
                                    6⤵
                                      PID:5220
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im metina_1.exe /f
                                        7⤵
                                        • Kills process with taskkill
                                        PID:1708
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        7⤵
                                        • Delays execution with timeout.exe
                                        PID:6088
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_2.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2656
                                  • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_2.exe
                                    metina_2.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:2360
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_4.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3332
                                  • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_4.exe
                                    metina_4.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3260
                                    • C:\Users\Admin\AppData\Local\Temp\is-AVDNK.tmp\metina_4.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\is-AVDNK.tmp\metina_4.tmp" /SL5="$3006A,189670,105984,C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_4.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:924
                                      • C:\Users\Admin\AppData\Local\Temp\is-1C05F.tmp\(_____(_(_________))235 Smeargle.exe
                                        "C:\Users\Admin\AppData\Local\Temp\is-1C05F.tmp\(_____(_(_________))235 Smeargle.exe" /S /UID=burnerch1
                                        7⤵
                                          PID:4436
                                          • C:\Program Files\VideoLAN\OVGRETCXOG\ultramediaburner.exe
                                            "C:\Program Files\VideoLAN\OVGRETCXOG\ultramediaburner.exe" /VERYSILENT
                                            8⤵
                                            • Executes dropped EXE
                                            PID:708
                                            • C:\Users\Admin\AppData\Local\Temp\is-13P91.tmp\ultramediaburner.tmp
                                              "C:\Users\Admin\AppData\Local\Temp\is-13P91.tmp\ultramediaburner.tmp" /SL5="$202E0,281924,62464,C:\Program Files\VideoLAN\OVGRETCXOG\ultramediaburner.exe" /VERYSILENT
                                              9⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Drops file in Program Files directory
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              PID:4420
                                              • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                10⤵
                                                • Executes dropped EXE
                                                PID:1264
                                          • C:\Users\Admin\AppData\Local\Temp\a5-78bd6-de8-f81bc-7754b145ecb50\Hyvulucofu.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a5-78bd6-de8-f81bc-7754b145ecb50\Hyvulucofu.exe"
                                            8⤵
                                            • Executes dropped EXE
                                            PID:4136
                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                              dw20.exe -x -s 640
                                              9⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4740
                                          • C:\Users\Admin\AppData\Local\Temp\f9-ab7d2-c78-ce2b8-7968d5a756205\Siraerijole.exe
                                            "C:\Users\Admin\AppData\Local\Temp\f9-ab7d2-c78-ce2b8-7968d5a756205\Siraerijole.exe"
                                            8⤵
                                            • Executes dropped EXE
                                            PID:3312
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g3e1m1cb.a2q\001.exe & exit
                                              9⤵
                                                PID:4456
                                                • C:\Users\Admin\AppData\Local\Temp\g3e1m1cb.a2q\001.exe
                                                  C:\Users\Admin\AppData\Local\Temp\g3e1m1cb.a2q\001.exe
                                                  10⤵
                                                    PID:5516
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s2wmchev.ekx\GcleanerEU.exe /eufive & exit
                                                  9⤵
                                                    PID:3972
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0xcmebgu.pb4\installer.exe /qn CAMPAIGN="654" & exit
                                                    9⤵
                                                      PID:2284
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l2ndassb.g1u\gaoou.exe & exit
                                                      9⤵
                                                      • Executes dropped EXE
                                                      PID:1808
                                                      • C:\Users\Admin\AppData\Local\Temp\l2ndassb.g1u\gaoou.exe
                                                        C:\Users\Admin\AppData\Local\Temp\l2ndassb.g1u\gaoou.exe
                                                        10⤵
                                                          PID:4456
                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                            11⤵
                                                              PID:5840
                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                              11⤵
                                                                PID:5516
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5gkhjb5e.m2s\Setup3310.exe /Verysilent /subid=623 & exit
                                                            9⤵
                                                              PID:5824
                                                              • C:\Users\Admin\AppData\Local\Temp\5gkhjb5e.m2s\Setup3310.exe
                                                                C:\Users\Admin\AppData\Local\Temp\5gkhjb5e.m2s\Setup3310.exe /Verysilent /subid=623
                                                                10⤵
                                                                  PID:6036
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-48571.tmp\Setup3310.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-48571.tmp\Setup3310.tmp" /SL5="$801F0,138429,56832,C:\Users\Admin\AppData\Local\Temp\5gkhjb5e.m2s\Setup3310.exe" /Verysilent /subid=623
                                                                    11⤵
                                                                      PID:4592
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-S4OL1.tmp\Setup.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-S4OL1.tmp\Setup.exe" /Verysilent
                                                                        12⤵
                                                                          PID:5980
                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                            13⤵
                                                                              PID:820
                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                14⤵
                                                                                  PID:4452
                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                  14⤵
                                                                                    PID:6192
                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                  13⤵
                                                                                    PID:3176
                                                                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                      14⤵
                                                                                        PID:1820
                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe
                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"
                                                                                      13⤵
                                                                                        PID:5068
                                                                                        • C:\Users\Admin\AppData\Roaming\2146626.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\2146626.exe"
                                                                                          14⤵
                                                                                            PID:4336
                                                                                          • C:\Users\Admin\AppData\Roaming\5575555.exe
                                                                                            "C:\Users\Admin\AppData\Roaming\5575555.exe"
                                                                                            14⤵
                                                                                              PID:5496
                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                15⤵
                                                                                                  PID:6172
                                                                                              • C:\Users\Admin\AppData\Roaming\1257000.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\1257000.exe"
                                                                                                14⤵
                                                                                                  PID:6092
                                                                                                  • C:\Users\Admin\AppData\Roaming\1257000.exe
                                                                                                    "{path}"
                                                                                                    15⤵
                                                                                                      PID:4540
                                                                                                  • C:\Users\Admin\AppData\Roaming\8506527.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\8506527.exe"
                                                                                                    14⤵
                                                                                                      PID:5912
                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                    13⤵
                                                                                                      PID:5528
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-5QAOL.tmp\LabPicV3.tmp
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-5QAOL.tmp\LabPicV3.tmp" /SL5="$30492,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                        14⤵
                                                                                                          PID:5364
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-C9E2C.tmp\_____________.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-C9E2C.tmp\_____________.exe" /S /UID=lab214
                                                                                                            15⤵
                                                                                                              PID:3164
                                                                                                              • C:\Program Files\Windows NT\OROSCGCFON\prolab.exe
                                                                                                                "C:\Program Files\Windows NT\OROSCGCFON\prolab.exe" /VERYSILENT
                                                                                                                16⤵
                                                                                                                  PID:6900
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-NTHNO.tmp\prolab.tmp
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-NTHNO.tmp\prolab.tmp" /SL5="$603A0,575243,216576,C:\Program Files\Windows NT\OROSCGCFON\prolab.exe" /VERYSILENT
                                                                                                                    17⤵
                                                                                                                      PID:7004
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b9-a0f03-bf6-da0a2-73ea85c237b6b\Hesaebaceby.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b9-a0f03-bf6-da0a2-73ea85c237b6b\Hesaebaceby.exe"
                                                                                                                    16⤵
                                                                                                                      PID:7016
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                        dw20.exe -x -s 632
                                                                                                                        17⤵
                                                                                                                          PID:7112
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2b-4487c-31d-da990-54dfe64155574\Fetykaecime.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2b-4487c-31d-da990-54dfe64155574\Fetykaecime.exe"
                                                                                                                        16⤵
                                                                                                                          PID:7076
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dr1qsr03.4ir\001.exe & exit
                                                                                                                            17⤵
                                                                                                                              PID:7728
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dr1qsr03.4ir\001.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\dr1qsr03.4ir\001.exe
                                                                                                                                18⤵
                                                                                                                                  PID:7292
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zlse45p2.dm0\GcleanerEU.exe /eufive & exit
                                                                                                                                17⤵
                                                                                                                                  PID:8076
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0a1jxq53.udk\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                  17⤵
                                                                                                                                    PID:5908
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\za52irtb.jdm\gaoou.exe & exit
                                                                                                                                    17⤵
                                                                                                                                      PID:7296
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\za52irtb.jdm\gaoou.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\za52irtb.jdm\gaoou.exe
                                                                                                                                        18⤵
                                                                                                                                          PID:6096
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                            19⤵
                                                                                                                                              PID:4764
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                              19⤵
                                                                                                                                                PID:5116
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mgv4phmj.jjf\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                            17⤵
                                                                                                                                              PID:7620
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mgv4phmj.jjf\Setup3310.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\mgv4phmj.jjf\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                18⤵
                                                                                                                                                  PID:7656
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-TODO3.tmp\Setup3310.tmp
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-TODO3.tmp\Setup3310.tmp" /SL5="$2059C,138429,56832,C:\Users\Admin\AppData\Local\Temp\mgv4phmj.jjf\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                    19⤵
                                                                                                                                                      PID:7976
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jcaeegcf.rzx\google-game.exe & exit
                                                                                                                                                  17⤵
                                                                                                                                                    PID:3908
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jcaeegcf.rzx\google-game.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jcaeegcf.rzx\google-game.exe
                                                                                                                                                      18⤵
                                                                                                                                                        PID:7772
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qgnwq5eh.buo\005.exe & exit
                                                                                                                                                      17⤵
                                                                                                                                                        PID:7444
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\qgnwq5eh.buo\005.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\qgnwq5eh.buo\005.exe
                                                                                                                                                          18⤵
                                                                                                                                                            PID:7980
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pbdwxeqe.ih2\GcleanerWW.exe /mixone & exit
                                                                                                                                                          17⤵
                                                                                                                                                            PID:7352
                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                    13⤵
                                                                                                                                                      PID:5788
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-5QAOK.tmp\lylal220.tmp
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-5QAOK.tmp\lylal220.tmp" /SL5="$204BC,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                        14⤵
                                                                                                                                                          PID:2468
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-G3CBC.tmp\56FT____________________.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-G3CBC.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                                                                                            15⤵
                                                                                                                                                              PID:6132
                                                                                                                                                              • C:\Program Files\Windows NT\OROSCGCFON\irecord.exe
                                                                                                                                                                "C:\Program Files\Windows NT\OROSCGCFON\irecord.exe" /VERYSILENT
                                                                                                                                                                16⤵
                                                                                                                                                                  PID:6956
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-QP7H1.tmp\irecord.tmp
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-QP7H1.tmp\irecord.tmp" /SL5="$7039C,6139911,56832,C:\Program Files\Windows NT\OROSCGCFON\irecord.exe" /VERYSILENT
                                                                                                                                                                    17⤵
                                                                                                                                                                      PID:6968
                                                                                                                                                                      • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                                        "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                        18⤵
                                                                                                                                                                          PID:7132
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fa-97e9d-240-0f3ab-6afce3018c794\Patyhytiva.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fa-97e9d-240-0f3ab-6afce3018c794\Patyhytiva.exe"
                                                                                                                                                                      16⤵
                                                                                                                                                                        PID:7004
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                          dw20.exe -x -s 540
                                                                                                                                                                          17⤵
                                                                                                                                                                            PID:5932
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b5-ffdbf-d3f-2a09f-43a9baa100818\Lacavivuru.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b5-ffdbf-d3f-2a09f-43a9baa100818\Lacavivuru.exe"
                                                                                                                                                                          16⤵
                                                                                                                                                                            PID:6548
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4dxf4skd.xrd\001.exe & exit
                                                                                                                                                                              17⤵
                                                                                                                                                                                PID:7776
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4dxf4skd.xrd\001.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\4dxf4skd.xrd\001.exe
                                                                                                                                                                                  18⤵
                                                                                                                                                                                    PID:7304
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\trwx3q2v.c3d\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                  17⤵
                                                                                                                                                                                    PID:8128
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uw1mt0y0.hbd\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                    17⤵
                                                                                                                                                                                      PID:7424
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4ozt0qtl.miv\gaoou.exe & exit
                                                                                                                                                                                      17⤵
                                                                                                                                                                                        PID:8024
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ozt0qtl.miv\gaoou.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\4ozt0qtl.miv\gaoou.exe
                                                                                                                                                                                          18⤵
                                                                                                                                                                                            PID:4180
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                              19⤵
                                                                                                                                                                                                PID:4640
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                19⤵
                                                                                                                                                                                                  PID:6364
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xbuoivnz.vzs\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                              17⤵
                                                                                                                                                                                                PID:7776
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\xbuoivnz.vzs\Setup3310.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\xbuoivnz.vzs\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                    PID:5764
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-A8CIT.tmp\Setup3310.tmp
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-A8CIT.tmp\Setup3310.tmp" /SL5="$303FA,138429,56832,C:\Users\Admin\AppData\Local\Temp\xbuoivnz.vzs\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                        PID:7944
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yuffn4kh.rik\google-game.exe & exit
                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                      PID:7448
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yuffn4kh.rik\google-game.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\yuffn4kh.rik\google-game.exe
                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gg3weiso.ici\005.exe & exit
                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                          PID:2252
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\gg3weiso.ici\005.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\gg3weiso.ici\005.exe
                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                              PID:6300
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iof5xz3q.zvn\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                              PID:6600
                                                                                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                        PID:2900
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                            PID:7044
                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                              taskkill /im RunWW.exe /f
                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pvbnzvp3.hbq\google-game.exe & exit
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                    PID:2212
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\pvbnzvp3.hbq\google-game.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\pvbnzvp3.hbq\google-game.exe
                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                        PID:5232
                                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                            PID:5280
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oh1i15ej.g1m\005.exe & exit
                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                          PID:6132
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\oh1i15ej.g1m\005.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\oh1i15ej.g1m\005.exe
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:5516
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y1tn05hv.l3c\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                              PID:4472
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q1i5osbl.ust\702564a0.exe & exit
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:6416
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\q1i5osbl.ust\702564a0.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\q1i5osbl.ust\702564a0.exe
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:6452
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qhddyud0.vq3\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                    PID:8164
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c metina_5.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:1184
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_5.exe
                                                                                                                                                                                                            metina_5.exe
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                            PID:792
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4184
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c metina_6.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:3468
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_6.exe
                                                                                                                                                                                                            metina_6.exe
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:492
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\4sqvo9DA7OvmYDqwUgK8a8Df.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\4sqvo9DA7OvmYDqwUgK8a8Df.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                              • C:\Program Files (x86)\Browzar\ix78ESOrnjfX.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Browzar\ix78ESOrnjfX.exe"
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:3580
                                                                                                                                                                                                                • C:\Program Files (x86)\Browzar\ix78ESOrnjfX.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Browzar\ix78ESOrnjfX.exe"
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                                  • C:\Program Files (x86)\Browzar\ix78ESOrnjfX.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Browzar\ix78ESOrnjfX.exe"
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:5756
                                                                                                                                                                                                                  • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 2260
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\BWSTmWr6pK2kxZHdpTL7M3fx.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\BWSTmWr6pK2kxZHdpTL7M3fx.exe"
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:5208
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\2DMn2ejbbb1wRgui9Ke5Ia4m.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\2DMn2ejbbb1wRgui9Ke5Ia4m.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                    • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:4584
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                          PID:5220
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                                                        • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                        • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                              PID:5472
                                                                                                                                                                                                                          • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:768
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\CAQyP7aH1eg9WbbhwabNxlRZ.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\CAQyP7aH1eg9WbbhwabNxlRZ.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2452
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c cmd < Buio.wks
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:1388
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                cmd
                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                  PID:4960
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                    findstr /V /R "^gzGCzYHflIhLniQKITQYNPlSSQLxDfdEGBGZiumHBAGxitJJGGODRjBnoOJDhhLUsJyWBRDBzovhpPKOueNXANMxZiQavWzgOLrnZ$" Indicibili.wks
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                      PID:5148
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Gioconda.exe.com
                                                                                                                                                                                                                                      Gioconda.exe.com t
                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                        PID:5496
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Gioconda.exe.com
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Gioconda.exe.com t
                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                          ping 127.0.0.1 -n 30
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                          PID:5712
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\eGNRwXKn1YMe1jMLJeorszsS.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\eGNRwXKn1YMe1jMLJeorszsS.exe"
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im "eGNRwXKn1YMe1jMLJeorszsS.exe" /f & erase "C:\Users\Admin\AppData\Roaming\eGNRwXKn1YMe1jMLJeorszsS.exe" & exit
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                          PID:6016
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                            taskkill /im "eGNRwXKn1YMe1jMLJeorszsS.exe" /f
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\djUMrhxas0TIuJVdU3I8O7qN.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\djUMrhxas0TIuJVdU3I8O7qN.exe"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\JKWzrtDg3G9bdedHKouzVIZX.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\JKWzrtDg3G9bdedHKouzVIZX.exe"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:3720
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\JKWzrtDg3G9bdedHKouzVIZX.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\JKWzrtDg3G9bdedHKouzVIZX.exe
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\NQES7kqpY4xND75UlvvAPEb9.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\NQES7kqpY4xND75UlvvAPEb9.exe"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:4088
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\NQES7kqpY4xND75UlvvAPEb9.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\NQES7kqpY4xND75UlvvAPEb9.exe
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\So0kUmoAv902XkUOHznYVr4T.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\So0kUmoAv902XkUOHznYVr4T.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4196
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\wm9PeHXcIjmfLPzFu5HHnJuk.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\wm9PeHXcIjmfLPzFu5HHnJuk.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                          PID:4956
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\wm9PeHXcIjmfLPzFu5HHnJuk.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\wm9PeHXcIjmfLPzFu5HHnJuk.exe"
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                            PID:3572
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Owkwf8SYiCLbJ3DTqrJm0wVI.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Owkwf8SYiCLbJ3DTqrJm0wVI.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\8yWcLp8JyEJwN18o1RT78d1G.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\8yWcLp8JyEJwN18o1RT78d1G.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qF7EycZe7PKhyXzLaIBNAFRR.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qF7EycZe7PKhyXzLaIBNAFRR.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:6116
                                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff82d9f4f50,0x7ff82d9f4f60,0x7ff82d9f4f70
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:2
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                      PID:6776
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1656 /prefetch:8
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:6788
                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2284 /prefetch:8
                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                          PID:6860
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:7092
                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                              PID:7084
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                PID:6268
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                  PID:6300
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                    PID:6344
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 /prefetch:8
                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                        PID:6584
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:8
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:7072
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                            PID:7896
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6366fa890,0x7ff6366fa8a0,0x7ff6366fa8b0
                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                PID:8008
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4076 /prefetch:8
                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                PID:8084
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3816 /prefetch:8
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                  PID:7216
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5920 /prefetch:8
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                    PID:4912
                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6052 /prefetch:8
                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                      PID:5168
                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5808 /prefetch:8
                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                        PID:7272
                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6036 /prefetch:8
                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                          PID:6348
                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5980 /prefetch:8
                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4040 /prefetch:8
                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                              PID:7372
                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 /prefetch:8
                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                PID:7692
                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 /prefetch:8
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                  PID:7664
                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:8
                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                    PID:7644
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4128 /prefetch:8
                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                      PID:7624
                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4148 /prefetch:8
                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                        PID:7596
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:8
                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                          PID:7576
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4176 /prefetch:8
                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                            PID:7540
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4152 /prefetch:8
                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                              PID:7520
                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4232 /prefetch:8
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                PID:7504
                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:8
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                  PID:7472
                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3860 /prefetch:8
                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                    PID:4084
                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6916 /prefetch:8
                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                      PID:7332
                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3880 /prefetch:8
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                        PID:432
                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5256 /prefetch:8
                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                          PID:2220
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:8
                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                            PID:5880
                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5100 /prefetch:8
                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                              PID:5708
                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3740 /prefetch:8
                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                PID:6304
                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3908 /prefetch:8
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                  PID:7800
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7448 /prefetch:8
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                    PID:6304
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7428 /prefetch:8
                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                      PID:7540
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7640 /prefetch:8
                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                        PID:7632
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7676 /prefetch:8
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                          PID:6524
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7608 /prefetch:8
                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                            PID:4452
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7636 /prefetch:8
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                              PID:1812
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7644 /prefetch:8
                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                PID:7564
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7672 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8036
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7680 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:7932
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7440
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3908 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2868
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5516 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5700
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2054883899105460194,12383653798129620476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7940
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "cmd.exe" /C taskkill /F /PID 5036 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\qF7EycZe7PKhyXzLaIBNAFRR.exe"
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6380
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                              taskkill /F /PID 5036
                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                              PID:6500
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "cmd.exe" /C taskkill /F /PID 5036 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\qF7EycZe7PKhyXzLaIBNAFRR.exe"
                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6372
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                taskkill /F /PID 5036
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                PID:6508
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\6FzI0cvlth4OpjMSkW5HZxZu.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\6FzI0cvlth4OpjMSkW5HZxZu.exe"
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            PID:4952
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Ab7NpqTkyqHsnQoeejxRdkg0.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Ab7NpqTkyqHsnQoeejxRdkg0.exe"
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:4672
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\5snoJJ1IpFIYei5DNTa8bdpU.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\5snoJJ1IpFIYei5DNTa8bdpU.exe"
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            PID:872
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "metina_6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_6.exe" & exit
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5316
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                taskkill /im "metina_6.exe" /f
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                PID:5524
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c metina_7.exe
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                          PID:868
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_7.exe
                                                                                                                                                                                                                                                                                                                                                            metina_7.exe
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                            PID:2760
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c metina_8.exe
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                          PID:672
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_8.exe
                                                                                                                                                                                                                                                                                                                                                            metina_8.exe
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:4072
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c metina_3.exe
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                          PID:3384
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS42FCB954\metina_3.exe
                                                                                                                                                                                                                                                                                                                                                            metina_3.exe
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                            PID:4044
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                      PID:1020
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                        PID:4648
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SVHOST.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SVHOST.exe
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                      PID:2040
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SVHOST.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SVHOST.exe"
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:8020
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\E35C.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\E35C.exe
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6016
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\F83D.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\F83D.exe
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7440
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\722.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\722.exe
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:7264
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1F10.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1F10.exe
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:8152
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1F10.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1F10.exe
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39DC.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\39DC.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:7964
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7792.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7792.exe
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7512
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7997.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7997.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7800

                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                                            memory/60-237-0x0000028951A60000-0x0000028951AD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/492-188-0x0000000002EC0000-0x0000000002EC2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/492-171-0x0000000000E80000-0x0000000000E81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/708-343-0x0000000000400000-0x0000000000416000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/768-353-0x0000000000430000-0x000000000057A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/768-355-0x0000000000430000-0x000000000057A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/924-189-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1020-247-0x000001F4F3030000-0x000001F4F30A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1044-291-0x0000012700510000-0x0000012700581000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1092-276-0x00000265F7700000-0x00000265F7771000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1228-308-0x0000020D98540000-0x0000020D985B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1264-360-0x0000000002A70000-0x0000000002A72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1296-321-0x000001929F660000-0x000001929F6D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1380-318-0x000001C362470000-0x000001C3624E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1836-320-0x000002B6DE8B0000-0x000002B6DE921000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1964-357-0x0000000004CF0000-0x0000000004D06000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-192-0x0000000005AF0000-0x0000000005AF1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-201-0x0000000005AD0000-0x0000000005AD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-199-0x0000000006320000-0x0000000006321000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-196-0x0000000005530000-0x0000000005531000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-197-0x0000000073370000-0x00000000733F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-194-0x0000000005730000-0x0000000005731000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-184-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-193-0x0000000005690000-0x0000000005691000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2040-210-0x00000000062A0000-0x00000000062BE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2180-294-0x0000000005E40000-0x0000000005E41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2180-310-0x0000000005820000-0x0000000005821000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2180-307-0x0000000005740000-0x0000000005741000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2180-309-0x0000000005A00000-0x0000000005A01000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2180-317-0x0000000002F20000-0x0000000002F21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2180-298-0x0000000005630000-0x0000000005631000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2180-280-0x0000000000C60000-0x0000000000C61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2360-330-0x0000000000400000-0x0000000000C0E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2360-331-0x0000000000D60000-0x0000000000D69000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2368-249-0x000001B8B0BA0000-0x000001B8B0C11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2388-277-0x0000015BBB140000-0x0000015BBB1B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2604-219-0x0000029CE79B0000-0x0000029CE79FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2604-227-0x0000029CE8300000-0x0000029CE8371000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2700-314-0x0000028873E30000-0x0000028873EA1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2716-316-0x000001E9E0F00000-0x000001E9E0F71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3260-169-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3312-351-0x0000000002440000-0x0000000002442000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3356-178-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3356-168-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3356-133-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3356-174-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3356-134-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3356-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3356-131-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3356-175-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3580-335-0x00000000053E0000-0x00000000058DE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3720-322-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3720-301-0x0000000000560000-0x0000000000561000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3884-328-0x0000000000400000-0x0000000000C68000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3884-325-0x0000000002920000-0x00000000029B7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4072-182-0x0000000000020000-0x0000000000021000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4072-198-0x0000000004A00000-0x0000000004A01000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4088-299-0x0000000000350000-0x0000000000351000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4088-312-0x0000000004C80000-0x0000000004C81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4136-350-0x000002BE48AE0000-0x000002BE48AE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4420-352-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4420-215-0x0000000004A2C000-0x0000000004B2D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4420-216-0x0000000004900000-0x000000000495C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4436-208-0x000001B7DE030000-0x000001B7DE031000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4436-212-0x000001B7DE270000-0x000001B7DE27F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4436-221-0x000001B7F8720000-0x000001B7F8722000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4648-225-0x0000022E5CDD0000-0x0000022E5CE41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4648-349-0x0000022E5F500000-0x0000022E5F606000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4648-354-0x0000022E5CEB0000-0x0000022E5CECA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4672-361-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4804-244-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4804-285-0x0000000005840000-0x000000000585B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4804-272-0x00000000055C0000-0x0000000005ABE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4804-268-0x0000000005860000-0x0000000005861000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4948-326-0x0000000005680000-0x0000000005681000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4952-347-0x0000000004A80000-0x0000000004A81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5100-329-0x0000000001140000-0x0000000001141000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download