f8ed25d648227480c94c7002e27e8c09c3501b5898cb8fdbbf9df9d5eddf0f15

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NulsultanLoader.exe
Size 459KB
Sample240601-ss4kysfe3s
SHA256 f8ed25d648227480c94c7002e27e8c09c3501b5898cb8fdbbf9df9d5eddf0f15
MD5 94af4c079ad32d2f0667ad7949a482d6
SHA1 d4d513699b3b1a6348210e598b17527ff5aab2e9
SHA512 a88526ff808518eb7a034a9add1a7004daa1b69fa98cd77aca859432f5ef76edc76ed1d5c1a18cc4cbab84063a676a7ce0fe48f777cc4a96f31c612e064a2b0c
SSDEEP 6144:SWR6MQer0SYX16re6VlWT8b9u9QLUOTo+MyXDv5AcJbEP41fMn:SJMQeoJ1mPVle8boko+HokfM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\xdwdSpotify.exe"	NulsultanLoader.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Loads dropped DLL 50 IoCs

pid	Process
1800	Process not Found
2376	Process not Found
3032	Process not Found
4856	Process not Found
3444	WmiApSrv.exe
3108	Process not Found
720	Process not Found
4332	Process not Found
2920	Process not Found
2976	Process not Found
1132	Process not Found
2556	Process not Found
5064	Process not Found
2780	Process not Found
2632	Process not Found
1368	Process not Found
2152	Process not Found
4804	Process not Found
1776	Process not Found
3280	Process not Found
804	Process not Found
468	Process not Found
1796	Process not Found
628	chrome.exe
4792	chrome.exe
228	Process not Found
1780	chrome.exe
4108	elevation_service.exe
4520	chrome.exe
3708	Process not Found
3820	chrome.exe
2216	Process not Found
5096	Process not Found
3740	Process not Found
3068	Process not Found
3980	AUDIODG.EXE
4212	chrome.exe
1996	chrome.exe
880	Process not Found
1992	Process not Found
4132	Process not Found
1136	Process not Found
868	Process not Found
1776	Process not Found
1132	Process not Found
4228	Process not Found
1040	Process not Found
5052	Process not Found
640	Process not Found
4848	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
90	discord.com
91	discord.com
92	discord.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\xdwdSpotify.exe	NulsultanLoader.exe
File opened for modification	C:\Program Files\xdwdSpotify.exe	NulsultanLoader.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	NulsultanLoader.exe

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3140	schtasks.exe
864	schtasks.exe
4844	schtasks.exe
3168	schtasks.exe
3236	schtasks.exe
2096	schtasks.exe
2260	schtasks.exe
2936	schtasks.exe
3488	schtasks.exe
1172	schtasks.exe
2920	schtasks.exe
4216	schtasks.exe
3004	schtasks.exe
4696	schtasks.exe
812	schtasks.exe
3708	schtasks.exe
1244	schtasks.exe
664	schtasks.exe
3660	schtasks.exe
3748	schtasks.exe
2560	schtasks.exe
2216	schtasks.exe
4772	schtasks.exe
652	schtasks.exe
1684	schtasks.exe
1944	schtasks.exe
3724	schtasks.exe
2388	schtasks.exe
2972	schtasks.exe
3196	schtasks.exe
2672	schtasks.exe
3612	schtasks.exe
3352	schtasks.exe
2212	schtasks.exe
792	schtasks.exe
744	schtasks.exe
3528	schtasks.exe
3336	schtasks.exe
4020	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617291428974197"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{81115E81-18EC-4A5F-868D-EC64B018731B}	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
3444	WmiApSrv.exe
3444	WmiApSrv.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe
4904	NulsultanLoader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	NulsultanLoader.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: 33	3980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3980	AUDIODG.EXE
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe
Token: SeCreatePagefilePrivilege	4792	chrome.exe
Token: SeShutdownPrivilege	4792	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe
4792	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4768	4904	NulsultanLoader.exe	95
PID 4904 wrote to memory of 4768	4904	NulsultanLoader.exe	95
PID 4768 wrote to memory of 3724	4768	CMD.exe	97
PID 4768 wrote to memory of 3724	4768	CMD.exe	97
PID 4904 wrote to memory of 3236	4904	NulsultanLoader.exe	98
PID 4904 wrote to memory of 3236	4904	NulsultanLoader.exe	98
PID 3236 wrote to memory of 2920	3236	CMD.exe	100
PID 3236 wrote to memory of 2920	3236	CMD.exe	100
PID 4904 wrote to memory of 2976	4904	NulsultanLoader.exe	101
PID 4904 wrote to memory of 2976	4904	NulsultanLoader.exe	101
PID 2976 wrote to memory of 3660	2976	CMD.exe	103
PID 2976 wrote to memory of 3660	2976	CMD.exe	103
PID 4904 wrote to memory of 3760	4904	NulsultanLoader.exe	105
PID 4904 wrote to memory of 3760	4904	NulsultanLoader.exe	105
PID 3760 wrote to memory of 2388	3760	CMD.exe	107
PID 3760 wrote to memory of 2388	3760	CMD.exe	107
PID 4904 wrote to memory of 1552	4904	NulsultanLoader.exe	108
PID 4904 wrote to memory of 1552	4904	NulsultanLoader.exe	108
PID 1552 wrote to memory of 3748	1552	CMD.exe	110
PID 1552 wrote to memory of 3748	1552	CMD.exe	110
PID 4904 wrote to memory of 1320	4904	NulsultanLoader.exe	113
PID 4904 wrote to memory of 1320	4904	NulsultanLoader.exe	113
PID 1320 wrote to memory of 4216	1320	CMD.exe	115
PID 1320 wrote to memory of 4216	1320	CMD.exe	115
PID 4904 wrote to memory of 5052	4904	NulsultanLoader.exe	116
PID 4904 wrote to memory of 5052	4904	NulsultanLoader.exe	116
PID 5052 wrote to memory of 3168	5052	CMD.exe	118
PID 5052 wrote to memory of 3168	5052	CMD.exe	118
PID 4904 wrote to memory of 396	4904	NulsultanLoader.exe	120
PID 4904 wrote to memory of 396	4904	NulsultanLoader.exe	120
PID 396 wrote to memory of 3528	396	CMD.exe	122
PID 396 wrote to memory of 3528	396	CMD.exe	122
PID 4904 wrote to memory of 4492	4904	NulsultanLoader.exe	123
PID 4904 wrote to memory of 4492	4904	NulsultanLoader.exe	123
PID 4492 wrote to memory of 2936	4492	CMD.exe	125
PID 4492 wrote to memory of 2936	4492	CMD.exe	125
PID 4904 wrote to memory of 3788	4904	NulsultanLoader.exe	126
PID 4904 wrote to memory of 3788	4904	NulsultanLoader.exe	126
PID 3788 wrote to memory of 2560	3788	CMD.exe	128
PID 3788 wrote to memory of 2560	3788	CMD.exe	128
PID 4904 wrote to memory of 1684	4904	NulsultanLoader.exe	129
PID 4904 wrote to memory of 1684	4904	NulsultanLoader.exe	129
PID 1684 wrote to memory of 3488	1684	CMD.exe	131
PID 1684 wrote to memory of 3488	1684	CMD.exe	131
PID 4904 wrote to memory of 1320	4904	NulsultanLoader.exe	132
PID 4904 wrote to memory of 1320	4904	NulsultanLoader.exe	132
PID 1320 wrote to memory of 4696	1320	CMD.exe	134
PID 1320 wrote to memory of 4696	1320	CMD.exe	134
PID 4904 wrote to memory of 1452	4904	NulsultanLoader.exe	135
PID 4904 wrote to memory of 1452	4904	NulsultanLoader.exe	135
PID 1452 wrote to memory of 652	1452	CMD.exe	137
PID 1452 wrote to memory of 652	1452	CMD.exe	137
PID 4904 wrote to memory of 4992	4904	NulsultanLoader.exe	138
PID 4904 wrote to memory of 4992	4904	NulsultanLoader.exe	138
PID 4992 wrote to memory of 3236	4992	CMD.exe	140
PID 4992 wrote to memory of 3236	4992	CMD.exe	140
PID 4904 wrote to memory of 2948	4904	NulsultanLoader.exe	141
PID 4904 wrote to memory of 2948	4904	NulsultanLoader.exe	141
PID 2948 wrote to memory of 812	2948	CMD.exe	143
PID 2948 wrote to memory of 812	2948	CMD.exe	143
PID 4904 wrote to memory of 4300	4904	NulsultanLoader.exe	144
PID 4904 wrote to memory of 4300	4904	NulsultanLoader.exe	144
PID 4300 wrote to memory of 3352	4300	CMD.exe	146
PID 4300 wrote to memory of 3352	4300	CMD.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NulsultanLoader.exe
"C:\Users\Admin\AppData\Local\Temp\NulsultanLoader.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "GIMP (GNU Image Manipulation Program)" /tr "C:\Program Files\xdwdSpotify.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "GIMP (GNU Image Manipulation Program)" /tr "C:\Program Files\xdwdSpotify.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Zoom" /tr "C:\Users\Admin\AppData\Roaming\xdwdMalwarebytes Update.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Zoom" /tr "C:\Users\Admin\AppData\Roaming\xdwdMalwarebytes Update.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2560
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:3672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:3476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:2268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:2292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:3672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4384
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1172
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1944
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:4820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit
  2⤵
  PID:1352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4772

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd59f1ab58,0x7ffd59f1ab68,0x7ffd59f1ab78
  2⤵
  - Loads dropped DLL
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:1
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4312 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4368 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4668 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4948 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4576 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3100 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4496 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=1776 --field-trial-handle=1888,i,11324217826510682565,11051916423373614055,131072 /prefetch:1
  2⤵
  PID:664

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Loads dropped DLL
PID:4108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384 0x46c
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1b9b0101b656e03953257b54e67e48763da0acfad188c76cca9b0ab8ed99a6ea
MD5 3a8697d9bfaf865a115b3bfd968c65e3
SHA1 29ecc4389afeea9b7882818aeda7770fa33b6b61
SHA512 c551c572b00554e2ed8b17dee32059b21ff5813b4bc2038e4c0ef4f4ff40b08f6ecf12a0089d10d230d537bef95288a4a3e17094aa8c099da5eb402c6ed77088
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 1f90c826d7af6418ab135f1dd298418357737e21564814f65a45c857434b3759
MD5 bad2d07b0599260f7df5241f3b756e3a
SHA1 7367dacb3c103923ff8a8d85474f6a84f3679c22
SHA512 d77de70688aca4391233fa1f6d7d0c11a2f71c1712e6349f1dfe3b74fcced80a39042c69810b6cd1f2f212a24354fb3c184af92b9f491cf67d6260287f0a416c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 65db1b6047aeb79405e9de95a56d93a49ee4f80eaf0da8f86262059e3a6a10ce
MD5 544e5716eb32f9e52bad359b3e8fe109
SHA1 2dead2c5ff491cde4a9784d906497ccd2b51b29f
SHA512 bf64198045fd88cfab3e79b32694e44aa4ba0db911e889b3f2e429adf90916e68769a69aa5613859dbca54a22bb29f0269246942afc0369f93a87686bbe6b8bd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 992a22b846b9e00c15ff74639e587e48c125c246ece9907bd2d13e5c9a7c82f5
MD5 edc882680efae8c332065ec8412953fe
SHA1 54e8a99e97cb3bb13bc2164e36e8652a22b774be
SHA512 01ee37ca0117b488589d4ccaa8e9defe6385f30da15ce4770ce036c5acefc109a1476c8bd0c111c8019e8c32a642d3a8eb61f8d51de633a052431d0836cbe671
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 225b2d877879db8bda75703cea5ea189af2a87fbee789b1a6ae47f3bb7929af6
MD5 a6033476c998d4be9bedca95019953b4
SHA1 b73483ec2bdc507f3bdf3b97bc8fba90ea805da6
SHA512 35420e4d59b09fe6e0d62a1c17346e445504f6a99aaad9e76b677ae88d2a2ba25b383fd8643a20725db8cf6f0c07fb7f790c00f3d82c5ed58fb2c3bf94901c85
SSDEEP 96:W9xqVquIXnG9qqTKIkJXtBI68iZRy7Dx+6MSmueOIO9AD6AzE2MEVhYtjEsXt0/g:a8nIxAaJdG68syh+Fe4DMP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 f11c46c9c695158ca9ee7623353f048a5c1ada3138cba182b4cf5b7f1e69f1a9
MD5 12ef1becf9b700eafd0c749d18d655de
SHA1 104df8347127258098ee155d5f0835666551ec70
SHA512 42efbcf2227743b2d0f8180bddbf9e01862c97221b9e83aedf95a600c617c7504b54874c67c0ff361a6bce60f5db8d3fc2a86ff5261261c5761976ec25970409
SSDEEP 192:acc2kJHnIxAaJdG68eRyx+FLuI0tvGADMP5tjEsXtScR:accHnChDy6BVAwtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 35b530c2672ebfcc4574410c23d3e16c797914a2f85768c53b5af31d951b140a
MD5 11249c68300ae77d87f117379a4d0143
SHA1 44b976b08dc2f86ef0ce9cdadcbd94ed7a964848
SHA512 f4de2bfe48dc66e112c7c237ec9a2778333d7a83f343016e7f3b1754cbafd6c5562f64e03eb9d5fec2605ffd1c5a9912f2a085e2b945769cd41af9cb0f3caabd
SSDEEP 192:acc2kJHnIxAaJdG68eRyh+FL+tvG09DMP5tjEsXtScR:accHnChDyqvGwtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 b5d98db9d887a61a692f20aace645d96886779480d960dca91afd0d7e9608af5
MD5 01ca38c7f8053ca80d0cfa4d0aee4eaf
SHA1 d71b5771280115d109d773e78f64248d59bc9e5c
SHA512 7cc4bf8061d8a7adc751b6843037740db7910e3c5ea90ef0364ebb6f1bacc23f301054ebdbbc3fbd511ed8d72812e9c0c08d8dde7fab3f3b167ef8d507019dde
SSDEEP 384:aabo7pLhLcEv1rXl31kXqKf/pUZNCgVLH2Hf9ctrUdmHGDOs/cRy:a0o7pLhLZdzl31kXqKf/pUZNCgVLH2HD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 276eddfb97fc90a3932df24e59602564c0759e16c90dc9ce62bf8eb4a9800cbb
MD5 48d013d2a72c31070167d77804b5bf28
SHA1 80f6acdaf9d0d7a9df72fac0156040d48beac500
SHA512 b176e6490ec01393c711366f1af459cbc532ed29147599c0c19099092a2c869d956b0e53221b6f9b431842e3849feb30920cc7a5d12525ba9e545c976ad6c607
SSDEEP 6144:QL+Zo0UgrZJqMU4x5iUt0/7supTUvF9te35nfC5mgMatpv:FcTo5E/7supTUvFu35tgMypv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 92KB
SHA256 0c1de8dd950399c5727efe4c9b5ad7c6f8065ed1823c9a37890f0c9da03abeea
MD5 0dbf3731fa4463ac4fce8ec4e75bf6bd
SHA1 e549afc121a0720215675947c794d71221062c4c
SHA512 381ad5ff3e5a2e65672d48b2ec8accd66a007b2705e9501a8475e6190bffe81a60e96d6e3392ed51c1378681b329df8c0a0f074827dfde9aa395f4f0e2c1eb51
SSDEEP 384:y5+LxEQPDxj9T2hiS06/HxjqpnXikTElGiUV2dFrdXM2acbyxrupdv03HZu15Nz3:ziQAUDgf2NKxsbdcmKC6Zv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe59355e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59355e.TMP
Size 89KB
SHA256 1bf60972703bedf23edf83161f31c8fe858cf4014613f52055b4eff52154eac6
MD5 2502aa141266d2de6fb3cc1b418461cb
SHA1 e23eb786ae13c2b102cbea38246790002c911752
SHA512 19d270f56e605fb5bc4723603b05da15dfb82ac9397c1a26c1a453519971e88f9921275007d22a1089275180bc04627b0bf413714a006ab739b4a6c6e73704b8
SSDEEP 384:a5+LxEQPDxj9T8iS06/HxjqpnXikTElGiUV2dFrd0acbyxrupdv0Ej15Nza+XRvJ:LiQoUDp2NNxsbdcmKC6ZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4904-0-0x0000000000560000-0x00000000005D8000-memory.dmp

Download

memory/4904-434-0x000000001CB10000-0x000000001CC56000-memory.dmp

Download

memory/4904-264-0x00007FFD5DB10000-0x00007FFD5E5D1000-memory.dmp

Download

memory/4904-108-0x000000001CAF0000-0x000000001CB0E000-memory.dmp

Download

memory/4904-107-0x00000000026D0000-0x00000000026DC000-memory.dmp

Download

memory/4904-106-0x000000001CC70000-0x000000001CCE6000-memory.dmp

Download

memory/4904-105-0x00007FFD5DB13000-0x00007FFD5DB15000-memory.dmp

Download

memory/4904-30-0x00007FFD5DB10000-0x00007FFD5E5D1000-memory.dmp

Download

memory/4904-1-0x00007FFD5DB13000-0x00007FFD5DB15000-memory.dmp

Download