redline | hxxps://download853[.]mediafire[.]com/wctqoz098otg/ceenhsbil5q8b1e/Spotify[.]zip

Analysis

max time kernel
194s
max time network
202s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
07/10/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://download853.mediafire.com/wctqoz098otg/ceenhsbil5q8b1e/Spotify.zip
Sample221007-nn1ahsceam

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

82.115.223.56:39447

Attributes

auth_value
65d71af2b0ff4e6abeac01ce30df77ae

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1840-172-0x000000000F140000-0x000000000F168000-memory.dmp	family_redline

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ProgramEngine.exe

Executes dropped EXE 2 IoCs

pid	Process
1840	crack.exe
948	ProgramEngine.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5400	schtasks.exe
5580	schtasks.exe
5744	schtasks.exe
6032	schtasks.exe
6048	schtasks.exe
5224	schtasks.exe
5368	schtasks.exe
5296	schtasks.exe
5544	schtasks.exe
6064	schtasks.exe
6088	schtasks.exe
2184	schtasks.exe
1420	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2660	chrome.exe
2660	chrome.exe
2668	chrome.exe
2668	chrome.exe
4564	chrome.exe
4564	chrome.exe
3312	chrome.exe
3312	chrome.exe
2552	chrome.exe
2552	chrome.exe
4192	chrome.exe
4192	chrome.exe
2144	chrome.exe
2144	chrome.exe
3716	chrome.exe
3716	chrome.exe
4848	chrome.exe
4848	chrome.exe
2668	chrome.exe
2668	chrome.exe
4892	chrome.exe
4892	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
2752	chrome.exe
1840	crack.exe
1840	crack.exe
1840	crack.exe
4564	7zFM.exe
4564	7zFM.exe
948	ProgramEngine.exe
948	ProgramEngine.exe
4168	powershell.exe
4168	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4564	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4564	7zFM.exe
Token: 35	4564	7zFM.exe
Token: SeSecurityPrivilege	4564	7zFM.exe
Token: SeDebugPrivilege	1840	crack.exe
Token: SeDebugPrivilege	948	ProgramEngine.exe
Token: SeDebugPrivilege	4168	powershell.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
4564	7zFM.exe
4564	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2868	2668	chrome.exe	66
PID 2668 wrote to memory of 2868	2668	chrome.exe	66
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2068	2668	chrome.exe	68
PID 2668 wrote to memory of 2660	2668	chrome.exe	69
PID 2668 wrote to memory of 2660	2668	chrome.exe	69
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70
PID 2668 wrote to memory of 5032	2668	chrome.exe	70

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://download853.mediafire.com/wctqoz098otg/ceenhsbil5q8b1e/Spotify.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xa8,0xac,0x7ffaf1ef4f50,0x7ffaf1ef4f60,0x7ffaf1ef4f70
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1472 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4060 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7600 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7652 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8376 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2356 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=8324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=772 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1016 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8396 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1460,18320253119435134133,6184834508334647776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7396 /prefetch:8
  2⤵
  PID:1804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1360

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Spotify.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4564
- C:\Users\Admin\AppData\Local\Temp\7zO4D1A7E27\crack.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4D1A7E27\crack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\ProgramEngine.exe
    "C:\Users\Admin\AppData\Local\Temp\ProgramEngine.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C powershell -EncodedCommand "PAAjAFkAUQByAGEAZgBZAE0ARwB3AEYASwBWAFIAeAB1AG8AbwBLAGQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBwAFQAaAB2AFYAbQB6AGIARQBmAEYAUgB6AGkAagBoAFcAQgBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBEAHoAaQBDAHcAZwBXAGUAdwBPAFAAIwA+ACAAQAAoACAAPAAjAEwAUgBmAEkAUgB2AGsATQBTAHYAQQB1AEcAWgAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaQBOAHkAbgBSAFoAZwBTAEEASABSAHkAdQAjAD4AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACkAIAA8ACMAUwBhAEMAbABJAGQAcwBwAFMAYgBCAHEAWgBPACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0ASQBjAHQAawBrAHgAYQBUAEsAeQB1AEEAcgBvACMAPgA="
      4⤵
      PID:5092
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -EncodedCommand "PAAjAFkAUQByAGEAZgBZAE0ARwB3AEYASwBWAFIAeAB1AG8AbwBLAGQAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBwAFQAaAB2AFYAbQB6AGIARQBmAEYAUgB6AGkAagBoAFcAQgBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBEAHoAaQBDAHcAZwBXAGUAdwBPAFAAIwA+ACAAQAAoACAAPAAjAEwAUgBmAEkAUgB2AGsATQBTAHYAQQB1AEcAWgAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaQBOAHkAbgBSAFoAZwBTAEEASABSAHkAdQAjAD4AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACkAIAA8ACMAUwBhAEMAbABJAGQAcwBwAFMAYgBCAHEAWgBPACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0ASQBjAHQAawBrAHgAYQBUAEsAeQB1AEEAcgBvACMAPgA="
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:3384
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:6032
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:4128
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:6048
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:644
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:6088
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:1420
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:2892
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:6064
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:4512
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:5192
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:5296
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:5148
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:5224
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk332" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:5240
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk332" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:5544
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk88" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:5452
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk88" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:5744
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk12" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:5392
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk12" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:5580
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk86" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:5336
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk86" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:5400
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk441" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:5276
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk441" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
        5⤵
        Creates scheduled task(s)
        
        PID:5368
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off & SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      PID:5524
    - - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        
        PID:5916
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
      4⤵
      PID:5592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crack.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO4D1A7E27\crack.exe
Size 715.0MB
SHA256 c1cb43dee992d1c3377d77546c2ecddbe3cff6167e4f425fd57be2a0806285b8
MD5 32ff15576a8ce8bda6eb41db66788671
SHA1 e110c3fafee333247279534f044fcd03b3dfef0f
SHA512 ba8c5d507ed77ac49903459a76922ad6c713e1094cd2812267e63fdaa0708e0187b18fae34fe5dafd9bb9019d5445c7474da22be8a76e2696a4d67b1070baded
SSDEEP 12288:4OUeD1Z29w8JdQvsRIsSvNZvr6/nXTpH:j1Zuw8JdQEyjqXT
MD5 SHA1 SHA512 SSDEEP

Submit Download

crack.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO4D1A7E27\crack.exe
Size 715.0MB
SHA256 c1cb43dee992d1c3377d77546c2ecddbe3cff6167e4f425fd57be2a0806285b8
MD5 32ff15576a8ce8bda6eb41db66788671
SHA1 e110c3fafee333247279534f044fcd03b3dfef0f
SHA512 ba8c5d507ed77ac49903459a76922ad6c713e1094cd2812267e63fdaa0708e0187b18fae34fe5dafd9bb9019d5445c7474da22be8a76e2696a4d67b1070baded
SSDEEP 12288:4OUeD1Z29w8JdQvsRIsSvNZvr6/nXTpH:j1Zuw8JdQEyjqXT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spotify.zip

Path C:\Users\Admin\Downloads\Spotify.zip
Size 315KB
SHA256 e9c7ebec1241a0dd9e7e4e8d31684406dd43da4677c5ebb1f07c668c8d4d33a0
MD5 6623b82c7112a317b8add4c0532c2178
SHA1 318909bcf4411cb5faa9ee56969956e36c13cfec
SHA512 17cf029f97d671f24d35f70c54936a2f91d437c0e581d0fdf24e0f8a91f48863dd43bd4c3688331ab45f8f2402b40bae0c85d232197b6aa3f51a8251eb97b6e5
SSDEEP 6144:AtzZiWuZFJCJdmwm6s9P2jRDLtLEaZy3BBdu8eXpGDIOb2RXVdyFHHSzWiZFC:aLuZ/AddCGRDxxyxBw1AnMCxSqivC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-300-0x0000000007310000-0x000000000731A000-memory.dmp

Download

memory/948-281-0x00000000004E0000-0x0000000000572000-memory.dmp

Download

memory/1840-177-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-135-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-124-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-127-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-128-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-129-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-130-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-131-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-132-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-133-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-134-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-181-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-137-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-138-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-139-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-136-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-140-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-141-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-143-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-142-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-144-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-145-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-146-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-148-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-149-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-150-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-151-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-152-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-153-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-147-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-154-0x00000000001C0000-0x00000000001EB000-memory.dmp

Download

memory/1840-155-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-156-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-157-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-158-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-159-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-160-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-161-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-162-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-163-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-164-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-165-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-166-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-167-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-168-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-169-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-171-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-172-0x000000000F140000-0x000000000F168000-memory.dmp

Download

memory/1840-170-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-173-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-174-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-175-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-180-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-123-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-178-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-179-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-176-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-125-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-121-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-183-0x000000000F180000-0x000000000F786000-memory.dmp

Download

memory/1840-184-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-185-0x000000000F820000-0x000000000F92A000-memory.dmp

Download

memory/1840-186-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-187-0x000000000F950000-0x000000000F962000-memory.dmp

Download

memory/1840-188-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-189-0x000000000F970000-0x000000000F9AE000-memory.dmp

Download

memory/1840-190-0x00000000001C0000-0x00000000001EB000-memory.dmp

Download

memory/1840-192-0x000000000F9D0000-0x000000000FA1B000-memory.dmp

Download

memory/1840-197-0x000000000FB60000-0x000000000FBC6000-memory.dmp

Download

memory/1840-205-0x0000000010090000-0x000000001058E000-memory.dmp

Download

memory/1840-206-0x00000000105F0000-0x0000000010682000-memory.dmp

Download

memory/1840-208-0x00000000107A0000-0x0000000010962000-memory.dmp

Download

memory/1840-209-0x0000000010970000-0x0000000010E9C000-memory.dmp

Download

memory/1840-213-0x0000000010F30000-0x0000000010F80000-memory.dmp

Download

memory/1840-214-0x0000000011140000-0x00000000111B6000-memory.dmp

Download

memory/1840-122-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-182-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-120-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/1840-119-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Download

memory/4168-470-0x0000000007790000-0x0000000007AE0000-memory.dmp

Download

memory/4168-426-0x0000000006D40000-0x0000000006D62000-memory.dmp

Download

memory/4168-454-0x0000000006E10000-0x0000000006E76000-memory.dmp

Download

memory/4168-391-0x0000000006F80000-0x00000000075A8000-memory.dmp

Download

memory/4168-555-0x0000000007B60000-0x0000000007BAB000-memory.dmp

Download

memory/4168-548-0x0000000006DF0000-0x0000000006E0C000-memory.dmp

Download

memory/4168-382-0x0000000002D10000-0x0000000002D46000-memory.dmp

Download