Overview

overview

10

Static

static

2DBF583E20...11.exe

windows7_x64

10

2DBF583E20...11.exe

windows10_x64

Analysis

  • max time kernel
    31s
  • max time network
    108s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    18-06-2021 20:03

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Remote task has failed: Machine shutdown
Report Analysis Logs

General

  • Target

    2DBF583E20A1714EBB7AAF9B61CD4E11.exe

  • Size

    4.0MB

  • MD5

    2dbf583e20a1714ebb7aaf9b61cd4e11

  • SHA1

    bb38de8320bfe3aa7dabe6946b9c039184a05bb2

  • SHA256

    d4fb12766874defc4d6a9dda8cd8aa956fdac4352d874c04f9828743247510df

  • SHA512

    1e59dbbe24a5bac9ecd24840602adcc4ac891d00aa73f825add5e79ce75e1ecfeb869d805c7098b452e9c6a9ef070324331a94db08a551cf71357c9adef29f80

Score
10/10
plugxredlinesmokeloadervidarbackdoorevasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 26 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • autoit_exe 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
      PID:1072
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Themes
      1⤵
        PID:1204
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s UserManager
        1⤵
          PID:1280
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Schedule
          1⤵
            PID:684
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1388
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
              1⤵
                PID:68
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1848
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                  1⤵
                    PID:2516
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                    1⤵
                      PID:2804
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2788
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Browser
                      1⤵
                        PID:2772
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                        1⤵
                          PID:2528
                        • C:\Users\Admin\AppData\Local\Temp\2DBF583E20A1714EBB7AAF9B61CD4E11.exe
                          "C:\Users\Admin\AppData\Local\Temp\2DBF583E20A1714EBB7AAF9B61CD4E11.exe"
                          1⤵
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:568
                          • C:\Users\Admin\AppData\Local\Temp\Files.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:756
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:3760
                          • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                            "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2964
                            • C:\Users\Admin\AppData\Roaming\6589672.exe
                              "C:\Users\Admin\AppData\Roaming\6589672.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:4372
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 4372 -s 680
                                4⤵
                                • Program crash
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2664
                            • C:\Users\Admin\AppData\Roaming\8962781.exe
                              "C:\Users\Admin\AppData\Roaming\8962781.exe"
                              3⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              PID:4524
                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:4592
                            • C:\Users\Admin\AppData\Roaming\8160729.exe
                              "C:\Users\Admin\AppData\Roaming\8160729.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:4496
                            • C:\Users\Admin\AppData\Roaming\1975349.exe
                              "C:\Users\Admin\AppData\Roaming\1975349.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:5112
                            • C:\Users\Admin\AppData\Roaming\8806792.exe
                              "C:\Users\Admin\AppData\Roaming\8806792.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4792
                              • C:\Users\Admin\AppData\Roaming\8806792.exe
                                C:\Users\Admin\AppData\Roaming\8806792.exe
                                4⤵
                                • Executes dropped EXE
                                PID:4740
                            • C:\Users\Admin\AppData\Roaming\3345469.exe
                              "C:\Users\Admin\AppData\Roaming\3345469.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:3384
                          • C:\Users\Admin\AppData\Local\Temp\Install.exe
                            "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                            2⤵
                            • Executes dropped EXE
                            • Modifies system certificate store
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2976
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c taskkill /f /im chrome.exe
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4480
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im chrome.exe
                                4⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4704
                          • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                            "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:2300
                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                              3⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4516
                          • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                            "C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:1824
                          • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                            "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of WriteProcessMemory
                            PID:2768
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              PID:4176
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3172
                          • C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe
                            "C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1660
                            • C:\Users\Admin\AppData\Local\Temp\is-LMLO2.tmp\IDWCH1.tmp
                              "C:\Users\Admin\AppData\Local\Temp\is-LMLO2.tmp\IDWCH1.tmp" /SL5="$10214,506086,422400,C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:2956
                              • C:\Users\Admin\AppData\Local\Temp\is-99QT2.tmp\(878888888(85)GSFG1G.exe
                                "C:\Users\Admin\AppData\Local\Temp\is-99QT2.tmp\(878888888(85)GSFG1G.exe" /S /UID=124
                                4⤵
                                • Drops file in Drivers directory
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in Program Files directory
                                PID:4416
                                • C:\Users\Admin\AppData\Local\Temp\32-2603b-065-3e587-c8dd994516c82\Niwymatuju.exe
                                  "C:\Users\Admin\AppData\Local\Temp\32-2603b-065-3e587-c8dd994516c82\Niwymatuju.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  PID:5036
                                • C:\Users\Admin\AppData\Local\Temp\7c-04ab6-083-dd095-5d282fd66dd0d\SHamugavofa.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7c-04ab6-083-dd095-5d282fd66dd0d\SHamugavofa.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2312
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\34sskotd.2f0\001.exe & exit
                                    6⤵
                                      PID:5200
                                      • C:\Users\Admin\AppData\Local\Temp\34sskotd.2f0\001.exe
                                        C:\Users\Admin\AppData\Local\Temp\34sskotd.2f0\001.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5480
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jiktrsdf.qdt\GcleanerEU.exe /eufive & exit
                                      6⤵
                                        PID:5228
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xsh1cxzk.1sd\installer.exe /qn CAMPAIGN="654" & exit
                                        6⤵
                                          PID:6032
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\42wrxcmn.zww\gaoou.exe & exit
                                          6⤵
                                            PID:5308
                                            • C:\Users\Admin\AppData\Local\Temp\42wrxcmn.zww\gaoou.exe
                                              C:\Users\Admin\AppData\Local\Temp\42wrxcmn.zww\gaoou.exe
                                              7⤵
                                              • Executes dropped EXE
                                              PID:5640
                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                8⤵
                                                  PID:4816
                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  8⤵
                                                    PID:6140
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z1nfu2x0.fgv\Setup3310.exe /Verysilent /subid=623 & exit
                                                6⤵
                                                  PID:6040
                                                  • C:\Users\Admin\AppData\Local\Temp\z1nfu2x0.fgv\Setup3310.exe
                                                    C:\Users\Admin\AppData\Local\Temp\z1nfu2x0.fgv\Setup3310.exe /Verysilent /subid=623
                                                    7⤵
                                                      PID:5652
                                                      • C:\Users\Admin\AppData\Local\Temp\is-MKL4U.tmp\Setup3310.tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\is-MKL4U.tmp\Setup3310.tmp" /SL5="$40380,138429,56832,C:\Users\Admin\AppData\Local\Temp\z1nfu2x0.fgv\Setup3310.exe" /Verysilent /subid=623
                                                        8⤵
                                                          PID:5976
                                                          • C:\Users\Admin\AppData\Local\Temp\is-JDLK6.tmp\Setup.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\is-JDLK6.tmp\Setup.exe" /Verysilent
                                                            9⤵
                                                              PID:5296
                                                              • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                10⤵
                                                                  PID:5816
                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                    11⤵
                                                                      PID:4424
                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                      11⤵
                                                                        PID:6164
                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                      10⤵
                                                                        PID:5240
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                          11⤵
                                                                            PID:7144
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /im RunWW.exe /f
                                                                              12⤵
                                                                              • Kills process with taskkill
                                                                              PID:6204
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout /t 6
                                                                              12⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:6028
                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                          10⤵
                                                                            PID:5988
                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                              11⤵
                                                                              • Executes dropped EXE
                                                                              PID:4816
                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
                                                                            10⤵
                                                                              PID:4596
                                                                              • C:\Users\Admin\AppData\Roaming\1882211.exe
                                                                                "C:\Users\Admin\AppData\Roaming\1882211.exe"
                                                                                11⤵
                                                                                  PID:1504
                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                    C:\Windows\system32\WerFault.exe -u -p 1504 -s 672
                                                                                    12⤵
                                                                                    • Program crash
                                                                                    PID:5504
                                                                                • C:\Users\Admin\AppData\Roaming\5144946.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\5144946.exe"
                                                                                  11⤵
                                                                                    PID:5736
                                                                                  • C:\Users\Admin\AppData\Roaming\3836610.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\3836610.exe"
                                                                                    11⤵
                                                                                      PID:5288
                                                                                    • C:\Users\Admin\AppData\Roaming\3741778.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\3741778.exe"
                                                                                      11⤵
                                                                                        PID:7016
                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                      10⤵
                                                                                        PID:6024
                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-0ES8F.tmp\lylal220.tmp
                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-0ES8F.tmp\lylal220.tmp" /SL5="$203F6,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                          11⤵
                                                                                            PID:5800
                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-3VT9F.tmp\56FT____________________.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-3VT9F.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                              12⤵
                                                                                                PID:5764
                                                                                                • C:\Program Files\Windows Sidebar\HDNYPMPUQW\irecord.exe
                                                                                                  "C:\Program Files\Windows Sidebar\HDNYPMPUQW\irecord.exe" /VERYSILENT
                                                                                                  13⤵
                                                                                                    PID:6444
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-ALDCM.tmp\irecord.tmp
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-ALDCM.tmp\irecord.tmp" /SL5="$4028C,6139911,56832,C:\Program Files\Windows Sidebar\HDNYPMPUQW\irecord.exe" /VERYSILENT
                                                                                                      14⤵
                                                                                                        PID:6464
                                                                                                        • C:\Program Files (x86)\recording\i-record.exe
                                                                                                          "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                          15⤵
                                                                                                            PID:6592
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ab-7007a-3ff-c7ea5-04b9b44b04035\ZHaeshuheqyko.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ab-7007a-3ff-c7ea5-04b9b44b04035\ZHaeshuheqyko.exe"
                                                                                                        13⤵
                                                                                                          PID:6492
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09-a9040-259-d47bc-8d632499d38b8\Xinydyjysha.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09-a9040-259-d47bc-8d632499d38b8\Xinydyjysha.exe"
                                                                                                          13⤵
                                                                                                            PID:6520
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hatx2xrn.pdr\001.exe & exit
                                                                                                              14⤵
                                                                                                                PID:5612
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hatx2xrn.pdr\001.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\hatx2xrn.pdr\001.exe
                                                                                                                  15⤵
                                                                                                                    PID:5536
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uj4fgk3x.htw\GcleanerEU.exe /eufive & exit
                                                                                                                  14⤵
                                                                                                                    PID:7164
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yb53vktz.bsy\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                    14⤵
                                                                                                                      PID:6856
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cwvcbuk2.0mp\gaoou.exe & exit
                                                                                                                      14⤵
                                                                                                                        PID:3820
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\cwvcbuk2.0mp\gaoou.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\cwvcbuk2.0mp\gaoou.exe
                                                                                                                          15⤵
                                                                                                                            PID:5936
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                              16⤵
                                                                                                                                PID:6684
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                16⤵
                                                                                                                                  PID:7820
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wli14m42.30n\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                              14⤵
                                                                                                                                PID:6332
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\wli14m42.30n\Setup3310.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\wli14m42.30n\Setup3310.exe /Verysilent /subid=623
                                                                                                                                  15⤵
                                                                                                                                    PID:7192
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-DLSVO.tmp\Setup3310.tmp
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-DLSVO.tmp\Setup3310.tmp" /SL5="$6033E,138429,56832,C:\Users\Admin\AppData\Local\Temp\wli14m42.30n\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                      16⤵
                                                                                                                                        PID:7228
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-PGTAO.tmp\Setup.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-PGTAO.tmp\Setup.exe" /Verysilent
                                                                                                                                          17⤵
                                                                                                                                            PID:636
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\liuhc2sg.sju\google-game.exe & exit
                                                                                                                                      14⤵
                                                                                                                                        PID:7516
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\liuhc2sg.sju\google-game.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\liuhc2sg.sju\google-game.exe
                                                                                                                                          15⤵
                                                                                                                                            PID:7668
                                                                                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                              16⤵
                                                                                                                                                PID:7916
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ze2gdvey.10a\005.exe & exit
                                                                                                                                            14⤵
                                                                                                                                              PID:7792
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ze2gdvey.10a\005.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\ze2gdvey.10a\005.exe
                                                                                                                                                15⤵
                                                                                                                                                  PID:7948
                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                        10⤵
                                                                                                                                          PID:5592
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-TVGFS.tmp\LabPicV3.tmp
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-TVGFS.tmp\LabPicV3.tmp" /SL5="$203F0,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                            11⤵
                                                                                                                                              PID:5964
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-HILKT.tmp\_____________.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-HILKT.tmp\_____________.exe" /S /UID=lab214
                                                                                                                                                12⤵
                                                                                                                                                  PID:5708
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\YKJCVSXEPW\prolab.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\YKJCVSXEPW\prolab.exe" /VERYSILENT
                                                                                                                                                    13⤵
                                                                                                                                                      PID:6200
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-LI971.tmp\prolab.tmp
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-LI971.tmp\prolab.tmp" /SL5="$20278,575243,216576,C:\Users\Admin\AppData\Local\Temp\YKJCVSXEPW\prolab.exe" /VERYSILENT
                                                                                                                                                        14⤵
                                                                                                                                                          PID:6236
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69-f3db4-737-0cebe-2f42ec94be068\Waecimefaele.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69-f3db4-737-0cebe-2f42ec94be068\Waecimefaele.exe"
                                                                                                                                                        13⤵
                                                                                                                                                          PID:6280
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\43-de459-007-34180-42b8eedb0ccff\Raenushaejiba.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\43-de459-007-34180-42b8eedb0ccff\Raenushaejiba.exe"
                                                                                                                                                          13⤵
                                                                                                                                                            PID:6312
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o2c2wkpk.3nk\001.exe & exit
                                                                                                                                                              14⤵
                                                                                                                                                                PID:3604
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\o2c2wkpk.3nk\001.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\o2c2wkpk.3nk\001.exe
                                                                                                                                                                  15⤵
                                                                                                                                                                    PID:6908
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rfwpyxw3.304\GcleanerEU.exe /eufive & exit
                                                                                                                                                                  14⤵
                                                                                                                                                                    PID:5592
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tohlul3n.noc\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                    14⤵
                                                                                                                                                                      PID:6960
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zywpabmf.tvi\gaoou.exe & exit
                                                                                                                                                                      14⤵
                                                                                                                                                                        PID:5144
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\zywpabmf.tvi\gaoou.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\zywpabmf.tvi\gaoou.exe
                                                                                                                                                                          15⤵
                                                                                                                                                                            PID:7060
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                              16⤵
                                                                                                                                                                                PID:5240
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                16⤵
                                                                                                                                                                                  PID:7844
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\24xcznmq.n0e\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                              14⤵
                                                                                                                                                                                PID:6992
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\24xcznmq.n0e\Setup3310.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\24xcznmq.n0e\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                  15⤵
                                                                                                                                                                                    PID:7248
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-Q8H2U.tmp\Setup3310.tmp
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-Q8H2U.tmp\Setup3310.tmp" /SL5="$1059A,138429,56832,C:\Users\Admin\AppData\Local\Temp\24xcznmq.n0e\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                      16⤵
                                                                                                                                                                                        PID:7280
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-I2Q0V.tmp\Setup.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-I2Q0V.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                          17⤵
                                                                                                                                                                                            PID:7976
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fsj4wyq2.isb\google-game.exe & exit
                                                                                                                                                                                      14⤵
                                                                                                                                                                                        PID:7608
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fsj4wyq2.isb\google-game.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\fsj4wyq2.isb\google-game.exe
                                                                                                                                                                                          15⤵
                                                                                                                                                                                            PID:7680
                                                                                                                                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                              16⤵
                                                                                                                                                                                                PID:7900
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vmxaghz3.v0j\005.exe & exit
                                                                                                                                                                                            14⤵
                                                                                                                                                                                              PID:7884
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vmxaghz3.v0j\005.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\vmxaghz3.v0j\005.exe
                                                                                                                                                                                                15⤵
                                                                                                                                                                                                  PID:4744
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vkk52cwz.2bs\google-game.exe & exit
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:5804
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vkk52cwz.2bs\google-game.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\vkk52cwz.2bs\google-game.exe
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:5828
                                                                                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:5832
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nqove2to.35c\005.exe & exit
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:5592
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nqove2to.35c\005.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\nqove2to.35c\005.exe
                                                                                                                                                                                          7⤵
                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                          PID:1824
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5333vcjo.kbh\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:8004
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ovm24bts.ig4\toolspab1.exe & exit
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:4512
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ovm24bts.ig4\toolspab1.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\ovm24bts.ig4\toolspab1.exe
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:4196
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ovm24bts.ig4\toolspab1.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ovm24bts.ig4\toolspab1.exe
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                        PID:1304
                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                      PID:900
                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4696
                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:2120
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:4972
                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        PID:4984
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:628
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:4696
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:5320
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:5912
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:6640
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4840
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:4000
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8955.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\8955.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5820
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\B306.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\B306.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:5916

                                                                                                                                                                                                Network

                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                • memory/68-178-0x00000178CDD60000-0x00000178CDDD1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/684-217-0x0000024816010000-0x0000024816081000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/900-189-0x0000022D8B5A0000-0x0000022D8B611000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1072-196-0x00000207F6760000-0x00000207F67D1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1204-225-0x000001CC611B0000-0x000001CC61221000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1280-229-0x000001CC40060000-0x000001CC400D1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1304-260-0x0000000000400000-0x0000000000C0F000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8.1MB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1304-259-0x0000000000C10000-0x0000000000D5A000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1388-219-0x000001263AA70000-0x000001263AAE1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1660-144-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  436KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1824-146-0x0000000000400000-0x00000000005DC000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.9MB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1824-241-0x0000000003780000-0x0000000003790000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1824-249-0x00000000039C0000-0x00000000039D0000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/1848-221-0x00000200F0B20000-0x00000200F0B91000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2120-287-0x00000221202A0000-0x00000221202EC000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  304KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2120-324-0x0000022122B00000-0x0000022122C06000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2120-325-0x0000022121DD0000-0x0000022121DEB000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  108KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2120-289-0x0000022120430000-0x00000221204A1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2312-309-0x0000000001682000-0x0000000001684000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2312-302-0x0000000001680000-0x0000000001682000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2312-310-0x0000000001684000-0x0000000001685000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2312-311-0x0000000001685000-0x0000000001686000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2516-184-0x00000238D2D40000-0x00000238D2DB1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2528-190-0x00000215CD140000-0x00000215CD1B1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2708-301-0x00000000024D0000-0x00000000024E6000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  88KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2772-195-0x00000292630C0000-0x0000029263131000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2788-232-0x00000264C0A40000-0x00000264C0AB1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2804-234-0x0000028F1D900000-0x0000028F1D971000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2956-160-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2964-150-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2964-137-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2964-149-0x0000000000A50000-0x0000000000A6B000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  108KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2964-127-0x0000000000330000-0x0000000000331000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/2964-155-0x000000001B040000-0x000000001B042000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/3384-304-0x0000000004D40000-0x0000000004D41000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4372-215-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4372-223-0x000000001B8D0000-0x000000001B8D2000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4416-275-0x000001FF199C0000-0x000001FF199C2000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4416-267-0x000001FF17C40000-0x000001FF17C41000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4496-269-0x0000000000380000-0x0000000000381000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4496-277-0x0000000004CC0000-0x0000000004D5C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  624KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4496-276-0x0000000004F80000-0x0000000004F81000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4516-174-0x00000000044C0000-0x000000000451C000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  368KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4516-170-0x0000000004540000-0x0000000004641000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4524-250-0x0000000009270000-0x0000000009271000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4524-257-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4524-258-0x0000000004360000-0x0000000004361000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4524-236-0x0000000000010000-0x0000000000011000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4524-238-0x0000000000920000-0x0000000000921000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4524-246-0x0000000002130000-0x000000000213E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4592-282-0x00000000011E0000-0x00000000011E1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4696-172-0x000001D5F8FE0000-0x000001D5F902B000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  300KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4696-183-0x000001D5F9300000-0x000001D5F9371000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4740-308-0x0000000005610000-0x0000000005611000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/4792-288-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5036-303-0x0000000002DD0000-0x0000000002DD2000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5112-281-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5480-320-0x0000000000480000-0x000000000052E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  696KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5480-319-0x00000000001F0000-0x0000000000200000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  64KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5652-336-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  80KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5976-339-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5976-337-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5976-343-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5976-341-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5976-342-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5976-340-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download

                                                                                                                                                                                                • memory/5976-338-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                  Download