amadey | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	asusns.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	stub.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	regasm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	request.exe

Executes dropped EXE 49 IoCs

pid	Process
3148	robotic.exe
3736	asusns.exe
4340	asusns.exe
3972	stub.exe
1236	build2.exe
2316	keylogger.exe
3252	svchost.exe
2356	networks_profile.exe
5100	backdoor.exe
4024	networks_profile.exe
2460	wahost.exe
3028	regasm.exe
4592	cookie250.exe
5064	Hkbsse.exe
5108	sahost.exe
3040	wahost.exe
3500	wahost.exe
3840	wahost.exe
3040	regasm.exe
3972	out_test_sig.exe
1780	TTF.exe
3460	T9.exe
2956	c7.exe
2744	mservice64.exe
3020	T7.exe
3820	nano.exe
1788	request.exe
2348	msvcservice.exe
1076	1111.exe
980	Hkbsse.exe
2936	msvcservice.exe
4612	Identifications.exe
3364	Hkbsse.exe
4440	msvcservice.exe
1848	pimer_bbbcontents7.exe
2928	pimer_bbbcontents7.exe
1956	pimer_bbbcontents7.exe
980	pimer_bbbcontents7.exe
1740	authenticator.exe
2912	exec.exe
4492	U.exe
2308	WE.exe
3316	Hkbsse.exe
4268	msvcservice.exe
2644	66b5d9d3adbaa_defaultr.exe
672	66af4e35e761b_doz.exe
1300	KEGDAKEHJD.exe
1704	CBKJJJDHDG.exe
4076	66b5b75106ac6_stealc.exe

Loads dropped DLL 13 IoCs

pid	Process
4024	networks_profile.exe
4024	networks_profile.exe
4024	networks_profile.exe
4024	networks_profile.exe
4024	networks_profile.exe
4024	networks_profile.exe
5108	sahost.exe
5108	sahost.exe
5108	sahost.exe
5108	sahost.exe
5108	sahost.exe
5108	sahost.exe
5108	sahost.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	request.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Manager = "C:\\Program Files (x86)\\DPI Manager\\dpimgr.exe"	nano.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nano.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
97	raw.githubusercontent.com
98	raw.githubusercontent.com
295	pastebin.com
297	pastebin.com
573	raw.githubusercontent.com
575	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
173	ip-api.io
174	ip-api.io
91	checkip.dyndns.org

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3556	tasklist.exe
5060	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5108	sahost.exe
2480	wab.exe

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 3736 set thread context of 4340	3736	asusns.exe	138
PID 2460 set thread context of 3840	2460	wahost.exe	207
PID 3028 set thread context of 3040	3028	regasm.exe	213
PID 1780 set thread context of 1108	1780	TTF.exe	219
PID 3460 set thread context of 5040	3460	T9.exe	223
PID 3020 set thread context of 3572	3020	T7.exe	258
PID 5108 set thread context of 2480	5108	sahost.exe	269
PID 1848 set thread context of 980	1848	pimer_bbbcontents7.exe	285
PID 4492 set thread context of 3120	4492	U.exe	291
PID 2308 set thread context of 4636	2308	WE.exe	292
PID 2644 set thread context of 4500	2644	66b5d9d3adbaa_defaultr.exe	299
PID 672 set thread context of 512	672	66af4e35e761b_doz.exe	305
PID 1300 set thread context of 1208	1300	KEGDAKEHJD.exe	308
PID 1704 set thread context of 1848	1704	CBKJJJDHDG.exe	310

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DPI Manager\dpimgr.exe	nano.exe
File opened for modification	C:\Program Files (x86)\DPI Manager\dpimgr.exe	nano.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Hkbsse.job	build2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000500000001dab1-179.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 60 IoCs

pid	pid_target	Process	procid_target
940	4340	WerFault.exe	138
4512	1236	WerFault.exe	155
1004	1236	WerFault.exe	155
3892	1236	WerFault.exe	155
3016	1236	WerFault.exe	155
4100	1236	WerFault.exe	155
592	1236	WerFault.exe	155
2312	1236	WerFault.exe	155
5008	1236	WerFault.exe	155
3040	1236	WerFault.exe	155
4416	1236	WerFault.exe	155
4612	5064	WerFault.exe	201
4488	5064	WerFault.exe	201
1680	5064	WerFault.exe	201
1848	5064	WerFault.exe	201
5044	5064	WerFault.exe	201
1648	5064	WerFault.exe	201
1252	5064	WerFault.exe	201
2908	5064	WerFault.exe	201
4356	5064	WerFault.exe	201
3132	5064	WerFault.exe	201
3572	5064	WerFault.exe	201
4488	5064	WerFault.exe	201
2928	980	WerFault.exe	259
2148	3364	WerFault.exe	271
2292	5064	WerFault.exe	201
5040	5064	WerFault.exe	201
4352	3316	WerFault.exe	293
3224	980	WerFault.exe	285
1508	5064	WerFault.exe	201
1824	5064	WerFault.exe	201
592	5064	WerFault.exe	201
856	1208	WerFault.exe	308
1632	368	WerFault.exe	323
4436	5064	WerFault.exe	201
1484	5064	WerFault.exe	201
1944	2268	WerFault.exe	338
3448	724	WerFault.exe	354
3368	640	WerFault.exe	390
3724	5088	WerFault.exe	398
4868	5064	WerFault.exe	201
2960	5064	WerFault.exe	201
1752	3156	WerFault.exe	414
1256	2960	WerFault.exe	420
4748	4116	WerFault.exe	434
4968	5064	WerFault.exe	201
516	5064	WerFault.exe	201
2360	2432	WerFault.exe	468
2360	4668	WerFault.exe	483
3608	3360	WerFault.exe	484
1908	5064	WerFault.exe	201
4580	5064	WerFault.exe	201
3936	1864	WerFault.exe	520
1504	5064	WerFault.exe	201
1288	5064	WerFault.exe	201
2452	4516	WerFault.exe	542
2772	4552	WerFault.exe	541
4852	428	WerFault.exe	551
1392	1648	WerFault.exe	576
5456	5136	WerFault.exe	619

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asusns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keylogger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TTF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pimer_bbbcontents7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nano.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pimer_bbbcontents7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	authenticator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66af4e35e761b_doz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvcservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b5d9d3adbaa_defaultr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CBKJJJDHDG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvcservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b5b75106ac6_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asusns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	out_test_sig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KEGDAKEHJD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backdoor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mservice64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	request.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvcservice.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
8	netsh.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1111.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pimer_bbbcontents7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pimer_bbbcontents7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
4940	timeout.exe
5008	timeout.exe
1104	timeout.exe
2492	timeout.exe
2904	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
4580	systeminfo.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	cookie250.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	cookie250.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 22 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1424	schtasks.exe
3724	schtasks.exe
4636	schtasks.exe
4000	schtasks.exe
1020	schtasks.exe
1964	schtasks.exe
4592	schtasks.exe
2532	schtasks.exe
756	schtasks.exe
632	schtasks.exe
4984	schtasks.exe
1256	schtasks.exe
1492	schtasks.exe
4900	schtasks.exe
3500	schtasks.exe
1864	schtasks.exe
4548	schtasks.exe
2644	schtasks.exe
3892	schtasks.exe
1164	schtasks.exe
5024	schtasks.exe
3208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3148	robotic.exe
1672	powershell.exe
4340	asusns.exe
1672	powershell.exe
724	msedge.exe
724	msedge.exe
4836	msedge.exe
4836	msedge.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3972	stub.exe
3588	identity_helper.exe
3588	identity_helper.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4592	cookie250.exe
4592	cookie250.exe
2460	wahost.exe
2460	wahost.exe
2460	wahost.exe
2460	wahost.exe
2460	wahost.exe
2460	wahost.exe
2460	wahost.exe
3840	wahost.exe
3840	wahost.exe
3028	regasm.exe
3028	regasm.exe
3028	regasm.exe
5008	powershell.exe
5008	powershell.exe
3028	regasm.exe
3040	regasm.exe
3040	regasm.exe
5008	powershell.exe
3840	wahost.exe
3040	regasm.exe
3020	T7.exe
3020	T7.exe
3820	nano.exe
3820	nano.exe
3820	nano.exe
3820	nano.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3820	nano.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5108	sahost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	New Text Document mod.exe
Token: SeDebugPrivilege	3148	robotic.exe
Token: SeBackupPrivilege	3148	robotic.exe
Token: SeSecurityPrivilege	3148	robotic.exe
Token: SeSecurityPrivilege	3148	robotic.exe
Token: SeSecurityPrivilege	3148	robotic.exe
Token: SeSecurityPrivilege	3148	robotic.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	4340	asusns.exe
Token: SeDebugPrivilege	3972	stub.exe
Token: SeDebugPrivilege	3252	svchost.exe
Token: SeDebugPrivilege	3252	svchost.exe
Token: SeDebugPrivilege	4592	cookie250.exe
Token: SeDebugPrivilege	2460	wahost.exe
Token: SeDebugPrivilege	3840	wahost.exe
Token: SeDebugPrivilege	3028	regasm.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	3040	regasm.exe
Token: SeDebugPrivilege	1780	TTF.exe
Token: SeDebugPrivilege	3460	T9.exe
Token: SeDebugPrivilege	3020	T7.exe
Token: SeDebugPrivilege	1108	RegAsm.exe
Token: SeBackupPrivilege	1108	RegAsm.exe
Token: SeSecurityPrivilege	1108	RegAsm.exe
Token: SeSecurityPrivilege	1108	RegAsm.exe
Token: SeSecurityPrivilege	1108	RegAsm.exe
Token: SeSecurityPrivilege	1108	RegAsm.exe
Token: SeDebugPrivilege	5040	RegAsm.exe
Token: SeDebugPrivilege	2744	mservice64.exe
Token: SeBackupPrivilege	5040	RegAsm.exe
Token: SeSecurityPrivilege	5040	RegAsm.exe
Token: SeSecurityPrivilege	5040	RegAsm.exe
Token: SeSecurityPrivilege	5040	RegAsm.exe
Token: SeSecurityPrivilege	5040	RegAsm.exe
Token: SeBackupPrivilege	2744	mservice64.exe
Token: SeSecurityPrivilege	2744	mservice64.exe
Token: SeSecurityPrivilege	2744	mservice64.exe
Token: SeSecurityPrivilege	2744	mservice64.exe
Token: SeSecurityPrivilege	2744	mservice64.exe
Token: SeDebugPrivilege	3820	nano.exe
Token: SeDebugPrivilege	1848	pimer_bbbcontents7.exe
Token: SeDebugPrivilege	1740	authenticator.exe
Token: SeDebugPrivilege	4492	U.exe
Token: SeDebugPrivilege	2308	WE.exe
Token: SeDebugPrivilege	2912	exec.exe
Token: SeDebugPrivilege	3120	RegAsm.exe
Token: SeDebugPrivilege	2644	66b5d9d3adbaa_defaultr.exe
Token: SeDebugPrivilege	672	66af4e35e761b_doz.exe
Token: SeDebugPrivilege	1680	powershell.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
1236	build2.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3148	3332	New Text Document mod.exe	128
PID 3332 wrote to memory of 3148	3332	New Text Document mod.exe	128
PID 3332 wrote to memory of 3736	3332	New Text Document mod.exe	132
PID 3332 wrote to memory of 3736	3332	New Text Document mod.exe	132
PID 3332 wrote to memory of 3736	3332	New Text Document mod.exe	132
PID 3736 wrote to memory of 1672	3736	asusns.exe	134
PID 3736 wrote to memory of 1672	3736	asusns.exe	134
PID 3736 wrote to memory of 1672	3736	asusns.exe	134
PID 3736 wrote to memory of 2644	3736	asusns.exe	136
PID 3736 wrote to memory of 2644	3736	asusns.exe	136
PID 3736 wrote to memory of 2644	3736	asusns.exe	136
PID 3736 wrote to memory of 4340	3736	asusns.exe	138
PID 3736 wrote to memory of 4340	3736	asusns.exe	138
PID 3736 wrote to memory of 4340	3736	asusns.exe	138
PID 3736 wrote to memory of 4340	3736	asusns.exe	138
PID 3736 wrote to memory of 4340	3736	asusns.exe	138
PID 3736 wrote to memory of 4340	3736	asusns.exe	138
PID 3736 wrote to memory of 4340	3736	asusns.exe	138
PID 3736 wrote to memory of 4340	3736	asusns.exe	138
PID 3332 wrote to memory of 4836	3332	New Text Document mod.exe	142
PID 3332 wrote to memory of 4836	3332	New Text Document mod.exe	142
PID 4836 wrote to memory of 4888	4836	msedge.exe	143
PID 4836 wrote to memory of 4888	4836	msedge.exe	143
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 3572	4836	msedge.exe	144
PID 4836 wrote to memory of 724	4836	msedge.exe	145

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloaders.zip
1⤵
PID:4060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3156

C:\Users\Admin\Desktop\New Text Document mod.exe
"C:\Users\Admin\Desktop\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\Desktop\a\robotic.exe
  "C:\Users\Admin\Desktop\a\robotic.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Users\Admin\Desktop\a\asusns.exe
  "C:\Users\Admin\Desktop\a\asusns.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OKmzKrla.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OKmzKrla" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8277.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2644
- - C:\Users\Admin\Desktop\a\asusns.exe
    "C:\Users\Admin\Desktop\a\asusns.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1524
      4⤵
      Program crash
      PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb166046f8,0x7ffb16604708,0x7ffb16604718
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4518794916916595571,5480145322560666575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:2732
- C:\Users\Admin\Desktop\a\stub.exe
  "C:\Users\Admin\Desktop\a\stub.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3092
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB678.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:208
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1104
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3252
- C:\Users\Admin\Desktop\a\build2.exe
  "C:\Users\Admin\Desktop\a\build2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 752
    3⤵
    - Program crash
    PID:4512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 796
    3⤵
    - Program crash
    PID:1004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 860
    3⤵
    - Program crash
    PID:3892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 912
    3⤵
    - Program crash
    PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 928
    3⤵
    - Program crash
    PID:4100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 860
    3⤵
    - Program crash
    PID:592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 1124
    3⤵
    - Program crash
    PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 1132
    3⤵
    - Program crash
    PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 1208
    3⤵
    - Program crash
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
    "C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 556
      4⤵
      Program crash
      PID:4612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 596
      4⤵
      Program crash
      PID:4488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 572
      4⤵
      Program crash
      PID:1680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 824
      4⤵
      Program crash
      PID:1848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 812
      4⤵
      Program crash
      PID:5044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 928
      4⤵
      Program crash
      PID:1648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 972
      4⤵
      Program crash
      PID:1252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 956
      4⤵
      Program crash
      PID:2908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 964
      4⤵
      Program crash
      PID:4356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1132
      4⤵
      Program crash
      PID:3132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1208
      4⤵
      Program crash
      PID:3572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1208
      4⤵
      Program crash
      PID:4488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1128
      4⤵
      Program crash
      PID:2292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 868
      4⤵
      Program crash
      PID:5040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 936
      4⤵
      Program crash
      PID:1508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1228
      4⤵
      Program crash
      PID:1824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1108
      4⤵
      Program crash
      PID:592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1248
      4⤵
      Program crash
      PID:4436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1244
      4⤵
      Program crash
      PID:1484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1376
      4⤵
      Program crash
      PID:4868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 968
      4⤵
      Program crash
      PID:2960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 968
      4⤵
      Program crash
      PID:4968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 792
      4⤵
      Program crash
      PID:516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1216
      4⤵
      Program crash
      PID:1908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1108
      4⤵
      Program crash
      PID:4580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1108
      4⤵
      Program crash
      PID:1504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 936
      4⤵
      Program crash
      PID:1288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 1200
    3⤵
    - Program crash
    PID:4416
- C:\Users\Admin\Desktop\a\keylogger.exe
  "C:\Users\Admin\Desktop\a\keylogger.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2316
- C:\Users\Admin\Desktop\a\networks_profile.exe
  "C:\Users\Admin\Desktop\a\networks_profile.exe"
  2⤵
  - Executes dropped EXE
  PID:2356
- - C:\Users\Admin\Desktop\a\networks_profile.exe
    "C:\Users\Admin\Desktop\a\networks_profile.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:5008
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:8
- C:\Users\Admin\Desktop\a\backdoor.exe
  "C:\Users\Admin\Desktop\a\backdoor.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5100
- C:\Users\Admin\Desktop\a\wahost.exe
  "C:\Users\Admin\Desktop\a\wahost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- - C:\Users\Admin\Desktop\a\wahost.exe
    "C:\Users\Admin\Desktop\a\wahost.exe"
    3⤵
    - Executes dropped EXE
    PID:3040
- - C:\Users\Admin\Desktop\a\wahost.exe
    "C:\Users\Admin\Desktop\a\wahost.exe"
    3⤵
    - Executes dropped EXE
    PID:3500
- - C:\Users\Admin\Desktop\a\wahost.exe
    "C:\Users\Admin\Desktop\a\wahost.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3840
- C:\Users\Admin\Desktop\a\regasm.exe
  "C:\Users\Admin\Desktop\a\regasm.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eVoVlc.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVoVlc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2687.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2532
- - C:\Users\Admin\Desktop\a\regasm.exe
    "C:\Users\Admin\Desktop\a\regasm.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3040
- C:\Users\Admin\Desktop\a\cookie250.exe
  "C:\Users\Admin\Desktop\a\cookie250.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Users\Admin\Desktop\a\sahost.exe
  "C:\Users\Admin\Desktop\a\sahost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:5108
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Users\Admin\Desktop\a\sahost.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:2480
- C:\Users\Admin\Desktop\a\out_test_sig.exe
  "C:\Users\Admin\Desktop\a\out_test_sig.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3972
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers system information
    PID:4580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-CimInstance -Class Win32_ComputerSystem
    3⤵
    PID:3904
- C:\Users\Admin\Desktop\a\TTF.exe
  "C:\Users\Admin\Desktop\a\TTF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\Users\Admin\Desktop\a\T9.exe
  "C:\Users\Admin\Desktop\a\T9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\Users\Admin\Desktop\a\c7.exe
  "C:\Users\Admin\Desktop\a\c7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2956
- C:\Users\Admin\Desktop\a\mservice64.exe
  "C:\Users\Admin\Desktop\a\mservice64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Users\Admin\Desktop\a\T7.exe
  "C:\Users\Admin\Desktop\a\T7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    PID:3488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3572
- C:\Users\Admin\Desktop\a\nano.exe
  "C:\Users\Admin\Desktop\a\nano.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Users\Admin\Desktop\a\request.exe
  "C:\Users\Admin\Desktop\a\request.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1788
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4900
- - C:\Users\Admin\msvcservice.exe
    "C:\Users\Admin\msvcservice.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2348
  - - C:\Windows\SysWOW64\schtasks.exe
      C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3208
- C:\Users\Admin\Desktop\a\1111.exe
  "C:\Users\Admin\Desktop\a\1111.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:1076
- C:\Users\Admin\Desktop\a\Identifications.exe
  "C:\Users\Admin\Desktop\a\Identifications.exe"
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe
  "C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- - C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe
    "C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe"
    3⤵
    - Executes dropped EXE
    PID:2928
- - C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe
    "C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe"
    3⤵
    - Executes dropped EXE
    PID:1956
- - C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe
    "C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:980
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1280
      4⤵
      Program crash
      PID:3224
- C:\Users\Admin\Desktop\a\authenticator.exe
  "C:\Users\Admin\Desktop\a\authenticator.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Users\Admin\Desktop\a\exec.exe
  "C:\Users\Admin\Desktop\a\exec.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Users\Admin\Desktop\a\U.exe
  "C:\Users\Admin\Desktop\a\U.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- C:\Users\Admin\Desktop\a\WE.exe
  "C:\Users\Admin\Desktop\a\WE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
- C:\Users\Admin\Desktop\a\66b5d9d3adbaa_defaultr.exe
  "C:\Users\Admin\Desktop\a\66b5d9d3adbaa_defaultr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4500
  - - C:\ProgramData\KEGDAKEHJD.exe
      "C:\ProgramData\KEGDAKEHJD.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1300
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 2160
        6⤵
        Program crash
        
        PID:856
  - - C:\ProgramData\CBKJJJDHDG.exe
      "C:\ProgramData\CBKJJJDHDG.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1704
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AFHDGDGIIDGC" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:696
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2492
- C:\Users\Admin\Desktop\a\66af4e35e761b_doz.exe
  "C:\Users\Admin\Desktop\a\66af4e35e761b_doz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:512
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\HJJEHJJKJEGH" & exit
      4⤵
      PID:4192
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:2904
- C:\Users\Admin\Desktop\a\66b5b75106ac6_stealc.exe
  "C:\Users\Admin\Desktop\a\66b5b75106ac6_stealc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1632
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 1260
      4⤵
      Program crash
      PID:1632
- C:\Users\Admin\Desktop\a\66b0ee142cf8f_PhotosExifEditor.exe
  "C:\Users\Admin\Desktop\a\66b0ee142cf8f_PhotosExifEditor.exe"
  2⤵
  PID:932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    3⤵
    PID:2752
- C:\Users\Admin\Desktop\a\66b837290469c_vidar.exe
  "C:\Users\Admin\Desktop\a\66b837290469c_vidar.exe"
  2⤵
  PID:4108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4392
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3736
- C:\Users\Admin\Desktop\a\66af531b832ee_main.exe
  "C:\Users\Admin\Desktop\a\66af531b832ee_main.exe"
  2⤵
  PID:3780
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3660
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\CBKJJEHCBAKF" & exit
      4⤵
      PID:3936
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4940
- C:\Users\Admin\Desktop\a\66b4af430a0a1_files.exe
  "C:\Users\Admin\Desktop\a\66b4af430a0a1_files.exe"
  2⤵
  PID:3572
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2776
- C:\Users\Admin\Desktop\a\66b85f47d1f63_stealc.exe
  "C:\Users\Admin\Desktop\a\66b85f47d1f63_stealc.exe"
  2⤵
  PID:1656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 1260
      4⤵
      Program crash
      PID:3724
- C:\Users\Admin\Desktop\a\66b74da9b163e_1234.exe
  "C:\Users\Admin\Desktop\a\66b74da9b163e_1234.exe"
  2⤵
  PID:3448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:8
- C:\Users\Admin\Desktop\a\66b5ace3a06b0_dozkey.exe
  "C:\Users\Admin\Desktop\a\66b5ace3a06b0_dozkey.exe"
  2⤵
  PID:3568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 2104
      4⤵
      Program crash
      PID:1752
- C:\Users\Admin\Desktop\a\66b331997e05e_main21.exe
  "C:\Users\Admin\Desktop\a\66b331997e05e_main21.exe"
  2⤵
  PID:2592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3352
- C:\Users\Admin\Desktop\a\66b5ac957cc65_crypta.exe
  "C:\Users\Admin\Desktop\a\66b5ac957cc65_crypta.exe"
  2⤵
  PID:3132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2336
- C:\Users\Admin\Desktop\a\66b7a2aef1283_doz.exe
  "C:\Users\Admin\Desktop\a\66b7a2aef1283_doz.exe"
  2⤵
  PID:980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:312
- C:\Users\Admin\Desktop\a\66b7d3a2e7a4d_deepweb.exe
  "C:\Users\Admin\Desktop\a\66b7d3a2e7a4d_deepweb.exe"
  2⤵
  PID:2800
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\elton.exe
      "C:\Users\Admin\AppData\Local\Temp\elton.exe"
      4⤵
      PID:1372
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:4748
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Roaming\mHrjTx5gm9.exe
        
        "C:\Users\Admin\AppData\Roaming\mHrjTx5gm9.exe"
        7⤵
        
        PID:1800
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Roaming\VD908R9QrD.exe
        
        "C:\Users\Admin\AppData\Roaming\VD908R9QrD.exe"
        7⤵
        
        PID:1840
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        
        PID:3260
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        
        PID:1300
- C:\Users\Admin\Desktop\a\ApertureLab.exe
  "C:\Users\Admin\Desktop\a\ApertureLab.exe"
  2⤵
  PID:4996
- - C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe
    "C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe"
    3⤵
    PID:4700
- C:\Users\Admin\Desktop\a\InstallerPack_20.1.23770_win64.exe
  "C:\Users\Admin\Desktop\a\InstallerPack_20.1.23770_win64.exe"
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1284
    3⤵
    - Program crash
    PID:4748
- C:\Users\Admin\Desktop\a\request.exe
  "C:\Users\Admin\Desktop\a\request.exe"
  2⤵
  PID:3212
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4636
- - C:\Users\Admin\msvcservice.exe
    "C:\Users\Admin\msvcservice.exe"
    3⤵
    PID:1064
  - - C:\Windows\SysWOW64\schtasks.exe
      C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4000
- C:\Users\Admin\Desktop\a\66b7d12b3a8ea_5k.exe
  "C:\Users\Admin\Desktop\a\66b7d12b3a8ea_5k.exe"
  2⤵
  PID:3260
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2228
  - - C:\Users\Admin\AppData\Roaming\aSP7IFTv7q.exe
      "C:\Users\Admin\AppData\Roaming\aSP7IFTv7q.exe"
      4⤵
      PID:1192
  - - C:\Users\Admin\AppData\Roaming\mh6nBsc93v.exe
      "C:\Users\Admin\AppData\Roaming\mh6nBsc93v.exe"
      4⤵
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\elton.exe
        
        "C:\Users\Admin\AppData\Local\Temp\elton.exe"
        5⤵
        
        PID:640
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1388
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4436
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:1896
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:3948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:1376
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:4536
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Roaming\1hEq8ht6po.exe
        
        "C:\Users\Admin\AppData\Roaming\1hEq8ht6po.exe"
        8⤵
        
        PID:2396
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Roaming\23heY5pPen.exe
        
        "C:\Users\Admin\AppData\Roaming\23heY5pPen.exe"
        8⤵
        
        PID:3780
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        
        PID:4132
- C:\Users\Admin\Desktop\a\66b7a4a075311_AsianAsp.exe
  "C:\Users\Admin\Desktop\a\66b7a4a075311_AsianAsp.exe"
  2⤵
  PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Everybody Everybody.cmd && Everybody.cmd && exit
    3⤵
    PID:3484
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3556
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5060
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:4356
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 693331
      4⤵
      PID:2928
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "CaughtDefineJournalCap" Credit
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Referral + ..\Lt + ..\Expanded + ..\Donor N
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\693331\Executives.pif
      Executives.pif N
      4⤵
      PID:1768
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:4868
- C:\Users\Admin\Desktop\a\NJTCFVIV.exe
  "C:\Users\Admin\Desktop\a\NJTCFVIV.exe"
  2⤵
  PID:1416
- - C:\Users\Admin\AppData\Local\Temp\identity_helper.exe
    "C:\Users\Admin\AppData\Local\Temp\identity_helper.exe"
    3⤵
    PID:2656
  - - C:\Users\Admin\AppData\Roaming\Ctrlfirefox_Rj_v5\identity_helper.exe
      C:\Users\Admin\AppData\Roaming\Ctrlfirefox_Rj_v5\identity_helper.exe
      4⤵
      PID:3776
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        
        PID:4820
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1240
        7⤵
        Program crash
        
        PID:2360
- C:\Users\Admin\Desktop\a\66af9bdbf0f60_Team.exe
  "C:\Users\Admin\Desktop\a\66af9bdbf0f60_Team.exe"
  2⤵
  PID:4024
- C:\Users\Admin\Desktop\a\66afa0d3934d8_ultfix.exe
  "C:\Users\Admin\Desktop\a\66afa0d3934d8_ultfix.exe"
  2⤵
  PID:4112
- C:\Users\Admin\Desktop\a\66b38609432fa_sosusion.exe
  "C:\Users\Admin\Desktop\a\66b38609432fa_sosusion.exe"
  2⤵
  PID:1492
- - C:\Users\Admin\AppData\Local\Temp\剖婈K
    "C:\Users\Admin\AppData\Local\Temp\剖婈K"
    3⤵
    PID:940
- C:\Users\Admin\Desktop\a\66b38b9ae0da3_palnet_new.exe
  "C:\Users\Admin\Desktop\a\66b38b9ae0da3_palnet_new.exe"
  2⤵
  PID:1388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2076
- C:\Users\Admin\Desktop\a\66ae9b239854c_crypto.exe
  "C:\Users\Admin\Desktop\a\66ae9b239854c_crypto.exe"
  2⤵
  PID:2284
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1112
- C:\Users\Admin\Desktop\a\66b4ed2ceb0d7_stealc.exe
  "C:\Users\Admin\Desktop\a\66b4ed2ceb0d7_stealc.exe"
  2⤵
  PID:1840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1188
      4⤵
      Program crash
      PID:2772
- C:\Users\Admin\Desktop\a\66b382f122c02_stk.exe
  "C:\Users\Admin\Desktop\a\66b382f122c02_stk.exe"
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4548
- - C:\Users\Admin\Desktop\a\66b382f122c02_stk.exe
    "C:\Users\Admin\Desktop\a\66b382f122c02_stk.exe"
    3⤵
    PID:3628
  - - C:\Users\Admin\Desktop\a\66b382f122c02_stk.exe
      "C:\Users\Admin\Desktop\a\66b382f122c02_stk.exe"
      4⤵
      PID:3148
- C:\Users\Admin\Desktop\a\66b09f01e0030_dozkey.exe
  "C:\Users\Admin\Desktop\a\66b09f01e0030_dozkey.exe"
  2⤵
  PID:4672
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:428
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\HCAEGCBFHJDG" & exit
      4⤵
      PID:2656
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:5008
- C:\Users\Admin\Desktop\a\66b5ac1092454_otraba.exe
  "C:\Users\Admin\Desktop\a\66b5ac1092454_otraba.exe"
  2⤵
  PID:3360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3800
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3520
- C:\Users\Admin\Desktop\a\66b0ba4420669_main.exe
  "C:\Users\Admin\Desktop\a\66b0ba4420669_main.exe"
  2⤵
  PID:4436
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2716
- C:\Users\Admin\Desktop\a\66b4b5e40dbf6_template832components.exe
  "C:\Users\Admin\Desktop\a\66b4b5e40dbf6_template832components.exe"
  2⤵
  PID:3684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1496
- C:\Users\Admin\Desktop\a\66ae96cb3d23b_crypted.exe
  "C:\Users\Admin\Desktop\a\66ae96cb3d23b_crypted.exe"
  2⤵
  PID:2272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4836
- C:\Users\Admin\Desktop\a\66b1b02a20b5a_cry.exe
  "C:\Users\Admin\Desktop\a\66b1b02a20b5a_cry.exe"
  2⤵
  PID:4852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3704
- C:\Users\Admin\Desktop\a\66b28454586cd_monogamer.exe
  "C:\Users\Admin\Desktop\a\66b28454586cd_monogamer.exe"
  2⤵
  PID:2904
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4476
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3120
- C:\Users\Admin\Desktop\a\66ae97ac4c30d_crypted.exe
  "C:\Users\Admin\Desktop\a\66ae97ac4c30d_crypted.exe"
  2⤵
  PID:2632
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1108
- C:\Users\Admin\Desktop\a\66b211924622f_LummaC2.exe
  "C:\Users\Admin\Desktop\a\66b211924622f_LummaC2.exe"
  2⤵
  PID:2912
- C:\Users\Admin\Desktop\a\66ab1b27ae40b_BotClient.exe
  "C:\Users\Admin\Desktop\a\66ab1b27ae40b_BotClient.exe"
  2⤵
  PID:1392
- C:\Users\Admin\Desktop\a\66b2871b47a8b_uhigdbf.exe
  "C:\Users\Admin\Desktop\a\66b2871b47a8b_uhigdbf.exe"
  2⤵
  PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
    3⤵
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
      clamer.exe -priverdD
      4⤵
      PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\fseawd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fseawd.exe"
        5⤵
        
        PID:1672
- C:\Users\Admin\Desktop\a\66ae1dd27873e_file.exe
  "C:\Users\Admin\Desktop\a\66ae1dd27873e_file.exe"
  2⤵
  PID:1844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2904
- C:\Users\Admin\Desktop\a\66b286b03f960_hp-scanner.exe
  "C:\Users\Admin\Desktop\a\66b286b03f960_hp-scanner.exe"
  2⤵
  PID:5136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 1040
    3⤵
    - Program crash
    PID:5456
- C:\Users\Admin\Desktop\a\66b31f0061c9a_doz.exe
  "C:\Users\Admin\Desktop\a\66b31f0061c9a_doz.exe"
  2⤵
  PID:5608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5892
- C:\Users\Admin\Desktop\a\66b62381ef649_crypted.exe
  "C:\Users\Admin\Desktop\a\66b62381ef649_crypted.exe"
  2⤵
  PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4340 -ip 4340
1⤵
PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1236 -ip 1236
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1236 -ip 1236
1⤵
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1236 -ip 1236
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1236 -ip 1236
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1236 -ip 1236
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1236 -ip 1236
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1236 -ip 1236
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1236 -ip 1236
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1236 -ip 1236
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1236 -ip 1236
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5064 -ip 5064
1⤵
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5064 -ip 5064
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5064 -ip 5064
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5064 -ip 5064
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5064 -ip 5064
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5064 -ip 5064
1⤵
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5064 -ip 5064
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5064 -ip 5064
1⤵
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5064 -ip 5064
1⤵
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5064 -ip 5064
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5064 -ip 5064
1⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 436
  2⤵
  - Program crash
  PID:2928

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2936
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5064 -ip 5064
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 980 -ip 980
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 440
  2⤵
  - Program crash
  PID:2148

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4440
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3364 -ip 3364
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5064 -ip 5064
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5064 -ip 5064
1⤵
PID:4680

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 448
  2⤵
  - Program crash
  PID:4352

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4268
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3316 -ip 3316
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 980 -ip 980
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5064 -ip 5064
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5064 -ip 5064
1⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5064 -ip 5064
1⤵
PID:4704

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 440
  2⤵
  - Program crash
  PID:1944

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:4380
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1208 -ip 1208
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 368 -ip 368
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5064 -ip 5064
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5064 -ip 5064
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2268 -ip 2268
1⤵
PID:2960

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 440
  2⤵
  - Program crash
  PID:3448

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:3352
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 724 -ip 724
1⤵
PID:4392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2b36cc40,0x7ffb2b36cc4c,0x7ffb2b36cc58
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,4266969576712655024,5967846985060285317,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,4266969576712655024,5967846985060285317,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2308,i,4266969576712655024,5967846985060285317,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,4266969576712655024,5967846985060285317,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,4266969576712655024,5967846985060285317,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4596,i,4266969576712655024,5967846985060285317,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4744,i,4266969576712655024,5967846985060285317,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,4266969576712655024,5967846985060285317,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4420
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff6e3a94698,0x7ff6e3a946a4,0x7ff6e3a946b0
    3⤵
    PID:2508

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 440
  2⤵
  - Program crash
  PID:3368

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:4992
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 640 -ip 640
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5088 -ip 5088
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5064 -ip 5064
1⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5064 -ip 5064
1⤵
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3156 -ip 3156
1⤵
PID:628

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 444
  2⤵
  - Program crash
  PID:1256

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:4240
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2960 -ip 2960
1⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4116 -ip 4116
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5064 -ip 5064
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5064 -ip 5064
1⤵
PID:3952

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 440
  2⤵
  - Program crash
  PID:2360

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:672
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2432 -ip 2432
1⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:3360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 440
  2⤵
  - Program crash
  PID:3608

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:2716
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4668 -ip 4668
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3360 -ip 3360
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5064 -ip 5064
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5064 -ip 5064
1⤵
PID:4748

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:1864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 444
  2⤵
  - Program crash
  PID:3936

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:4964
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1864 -ip 1864
1⤵
PID:1680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5064 -ip 5064
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5064 -ip 5064
1⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 440
  2⤵
  - Program crash
  PID:2452

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:2052
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4516 -ip 4516
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4552 -ip 4552
1⤵
PID:3768

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 448
  2⤵
  - Program crash
  PID:4852

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:2072
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 428 -ip 428
1⤵
PID:3232

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 444
  2⤵
  - Program crash
  PID:1392

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:592
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1648 -ip 1648
1⤵
PID:868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5136 -ip 5136
1⤵
PID:5432

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery