amadey | hxxp://ufile[.]io/eobsr3kv

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Phorphiex payload 6 IoCs

resource	yara_rule
behavioral1/files/0x000100000002ab2f-1446.dat	family_phorphiex
behavioral1/files/0x000100000002ab48-1716.dat	family_phorphiex
behavioral1/files/0x000100000002aaff-1767.dat	family_phorphiex
behavioral1/files/0x000100000002ab00-1837.dat	family_phorphiex
behavioral1/files/0x000100000002ab71-2150.dat	family_phorphiex
behavioral1/files/0x000100000002acc6-4401.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/files/0x000100000002ab02-1808.dat	family_redline
behavioral1/memory/2364-1810-0x00000000006F0000-0x0000000000742000-memory.dmp	family_redline
behavioral1/memory/1956-3020-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/files/0x000600000002a966-5489.dat	family_redline
behavioral1/files/0x000600000002a9af-5497.dat	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000600000002a966-5489.dat	family_sectoprat
behavioral1/files/0x000600000002a9af-5497.dat	family_sectoprat

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe

Contacts a large (57686) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4052	powershell.exe
5468	powershell.exe
9660	powershell.exe
7836	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk	66ab1b27ae40b_BotClient.exe

Executes dropped EXE 43 IoCs

pid	Process
2456	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
2340	13EB.exe
2700	18161440.exe
796	sysmysldrv.exe
5736	%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe
72	%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe
6060	1.exe
5016	sysarddrvs.exe
5716	44984851.exe
2364	4ck3rr.exe
4380	11.exe
5364	6632.exe
5896	66ab1b27ae40b_BotClient.exe
2104	66ab1b27ae40b_BotClient.exe
4288	66ab1b27ae40b_BotClient.exe
1652	66ab1b27ae40b_BotClient.exe
6004	66ae9b239854c_crypto.exe
2228	2737929190.exe
2012	66b1c36969eae_main.exe
2420	1410131485.exe
5656	123034073.exe
4988	66b09d7d34310_DefragManager.exe
1552	1111.exe
2148	a.exe
5528	8FF1.exe
1992	aaa.exe
1596	2903524228.exe
5516	9495.exe
5644	sysmablsvr.exe
5884	985D.exe
1904	abc.exe
2232	amadey.exe
1852	Utsysc.exe
2316	amadey.exe
3064	312335747.exe
824	317989421.exe
5680	build_2024-07-27_00-41.exe
2620	214712637.exe
4664	ChatLife.exe
2780	AA3F.exe
5368	clear.exe
1708	Crack.exe
5528	Crack.exe

Loads dropped DLL 2 IoCs

pid	Process
5936	MSBuild.exe
5936	MSBuild.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002aafe-1755.dat	upx
behavioral1/memory/5736-1758-0x0000000000B40000-0x0000000001B67000-memory.dmp	upx
behavioral1/memory/72-1761-0x0000000000B40000-0x0000000001B67000-memory.dmp	upx
behavioral1/memory/5736-1762-0x0000000000B40000-0x0000000001B67000-memory.dmp	upx
behavioral1/memory/72-1851-0x0000000000B40000-0x0000000001B67000-memory.dmp	upx
behavioral1/memory/5368-2420-0x0000000000400000-0x00000000004D0000-memory.dmp	upx
behavioral1/memory/5368-2424-0x0000000000400000-0x00000000004D0000-memory.dmp	upx
behavioral1/memory/1708-2548-0x0000000000EC0000-0x0000000001DCE000-memory.dmp	upx
behavioral1/memory/5528-2553-0x0000000000EC0000-0x0000000001DCE000-memory.dmp	upx
behavioral1/memory/1708-2552-0x0000000000EC0000-0x0000000001DCE000-memory.dmp	upx
behavioral1/memory/3472-2570-0x0000000000400000-0x00000000004D0000-memory.dmp	upx
behavioral1/memory/3472-2568-0x0000000000400000-0x00000000004D0000-memory.dmp	upx
behavioral1/memory/1012-2689-0x0000000000400000-0x000000000061DDB0-memory.dmp	upx
behavioral1/memory/4420-2701-0x0000000000400000-0x00000000004D0000-memory.dmp	upx
behavioral1/memory/4420-2699-0x0000000000400000-0x00000000004D0000-memory.dmp	upx
behavioral1/memory/2988-2727-0x0000000000060000-0x000000000021A000-memory.dmp	upx
behavioral1/memory/6088-2729-0x0000000000400000-0x00000000004E5DB0-memory.dmp	upx
behavioral1/memory/4812-2761-0x0000000000530000-0x00000000006EA000-memory.dmp	upx
behavioral1/memory/5528-2767-0x0000000000EC0000-0x0000000001DCE000-memory.dmp	upx
behavioral1/memory/3356-2772-0x0000000000400000-0x0000000000461DB0-memory.dmp	upx
behavioral1/memory/1012-2778-0x0000000000400000-0x000000000061DDB0-memory.dmp	upx
behavioral1/memory/2988-2808-0x0000000000060000-0x000000000021A000-memory.dmp	upx
behavioral1/memory/6088-2810-0x0000000000400000-0x00000000004E5DB0-memory.dmp	upx
behavioral1/memory/3356-2813-0x0000000000400000-0x0000000000461DB0-memory.dmp	upx
behavioral1/memory/4812-2815-0x0000000000530000-0x00000000006EA000-memory.dmp	upx
behavioral1/memory/5312-2832-0x0000000000400000-0x0000000000461DB0-memory.dmp	upx
behavioral1/memory/4244-2840-0x0000000000400000-0x0000000000461DB0-memory.dmp	upx
behavioral1/memory/1820-2848-0x0000000000400000-0x0000000000461DB0-memory.dmp	upx
behavioral1/memory/6088-2850-0x0000000000400000-0x00000000004E5DB0-memory.dmp	upx
behavioral1/memory/2988-2853-0x0000000000060000-0x000000000021A000-memory.dmp	upx
behavioral1/memory/1012-2855-0x0000000000400000-0x000000000061DDB0-memory.dmp	upx
behavioral1/memory/5312-2858-0x0000000000400000-0x0000000000461DB0-memory.dmp	upx
behavioral1/memory/5312-2862-0x0000000000400000-0x0000000000461DB0-memory.dmp	upx
behavioral1/memory/1820-2865-0x0000000000400000-0x0000000000461DB0-memory.dmp	upx
behavioral1/memory/4812-3046-0x0000000000530000-0x00000000006EA000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmysldrv.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmysldrv.exe"	18161440.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV6 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV6\\ExtreamFanV6.exe"	66ab1b27ae40b_BotClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\X:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\E:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\M:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\N:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\W:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\Z:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\A:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\G:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\L:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\P:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\Q:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\U:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\V:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\Y:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\J:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\K:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\I:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\O:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\R:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\S:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\T:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\B:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
File opened (read-only)	\??\H:	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
11250	iplogger.com
38533	pastebin.com
38963	pastebin.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10635	ip-api.io
10839	ip-api.io
41620	checkip.dyndns.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
9856	powercfg.exe
9456	powercfg.exe
6492	powercfg.exe
9588	powercfg.exe
3936	powercfg.exe
6756	powercfg.exe
10132	powercfg.exe
9504	powercfg.exe

AutoIT Executable 15 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/5368-2420-0x0000000000400000-0x00000000004D0000-memory.dmp	autoit_exe
behavioral1/memory/5368-2424-0x0000000000400000-0x00000000004D0000-memory.dmp	autoit_exe
behavioral1/memory/3472-2570-0x0000000000400000-0x00000000004D0000-memory.dmp	autoit_exe
behavioral1/memory/3472-2568-0x0000000000400000-0x00000000004D0000-memory.dmp	autoit_exe
behavioral1/memory/4420-2701-0x0000000000400000-0x00000000004D0000-memory.dmp	autoit_exe
behavioral1/memory/4420-2699-0x0000000000400000-0x00000000004D0000-memory.dmp	autoit_exe
behavioral1/memory/2988-2727-0x0000000000060000-0x000000000021A000-memory.dmp	autoit_exe
behavioral1/memory/1012-2778-0x0000000000400000-0x000000000061DDB0-memory.dmp	autoit_exe
behavioral1/memory/2988-2808-0x0000000000060000-0x000000000021A000-memory.dmp	autoit_exe
behavioral1/memory/6088-2810-0x0000000000400000-0x00000000004E5DB0-memory.dmp	autoit_exe
behavioral1/memory/4812-2815-0x0000000000530000-0x00000000006EA000-memory.dmp	autoit_exe
behavioral1/memory/6088-2850-0x0000000000400000-0x00000000004E5DB0-memory.dmp	autoit_exe
behavioral1/memory/2988-2853-0x0000000000060000-0x000000000021A000-memory.dmp	autoit_exe
behavioral1/memory/1012-2855-0x0000000000400000-0x000000000061DDB0-memory.dmp	autoit_exe
behavioral1/memory/4812-3046-0x0000000000530000-0x00000000006EA000-memory.dmp	autoit_exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4640	tasklist.exe
2032	tasklist.exe
6996	tasklist.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5896 set thread context of 1652	5896	66ab1b27ae40b_BotClient.exe	182
PID 6004 set thread context of 5096	6004	66ae9b239854c_crypto.exe	189
PID 2012 set thread context of 5936	2012	66b1c36969eae_main.exe	192

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\sysmysldrv.exe	18161440.exe
File opened for modification	C:\Windows\sysmysldrv.exe	18161440.exe
File created	C:\Windows\sysarddrvs.exe	1.exe
File opened for modification	C:\Windows\sysarddrvs.exe	1.exe
File created	C:\Windows\sysmablsvr.exe	a.exe
File opened for modification	C:\Windows\sysmablsvr.exe	a.exe

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1104	sc.exe
5864	sc.exe
2064	sc.exe
5428	sc.exe
5744	sc.exe
5668	sc.exe
5832	sc.exe
5920	sc.exe
3080	sc.exe
4316	sc.exe
3200	sc.exe
1804	sc.exe
4688	sc.exe
2084	sc.exe
8344	sc.exe
8952	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x000100000002ab05-2092.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5616	5680	WerFault.exe	213
1212	4988	WerFault.exe	196
10232	3328	WerFault.exe	320
8892	6632	WerFault.exe	333
6868	9492	WerFault.exe	422

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66ab1b27ae40b_BotClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Utsysc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18161440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	985D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13EB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66ae9b239854c_crypto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b1c36969eae_main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2903524228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66ab1b27ae40b_BotClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clear.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ck3rr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8FF1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	317989421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	214712637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44984851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amadey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmysldrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b09d7d34310_DefragManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build_2024-07-27_00-41.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123034073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	312335747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA3F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1410131485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChatLife.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2737929190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9495.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3868	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1111.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
5892	timeout.exe
4920	timeout.exe
1264	timeout.exe
5124	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 61 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "2"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 500031000000000002597d7c1000372d5a6970003c0009000400efbe02597c7c02597d7c2e0000000ca6010000001a0000000000000000000000000000009bea200137002d005a0069007000000014000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\NodeSlot = "3"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 8c003100000000001059553b110050524f4752417e310000740009000400efbec55259611059553b2e0000003f0000000000010000000000000000004a00000000008ed57500500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	4ck3rr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	4ck3rr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\saved from malware.7z:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4452	schtasks.exe
5072	schtasks.exe
8468	schtasks.exe
8636	schtasks.exe
6672	schtasks.exe
7704	schtasks.exe
5380	schtasks.exe
436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
104	msedge.exe
104	msedge.exe
3932	msedge.exe
3932	msedge.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5964	OpenWith.exe
1112	7zFM.exe
2892	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
5016	sysarddrvs.exe
5644	sysmablsvr.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	firefox.exe
Token: SeDebugPrivilege	5028	firefox.exe
Token: 33	3844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3844	AUDIODG.EXE
Token: SeDebugPrivilege	5028	firefox.exe
Token: SeDebugPrivilege	5028	firefox.exe
Token: SeDebugPrivilege	5028	firefox.exe
Token: SeDebugPrivilege	5028	firefox.exe
Token: SeDebugPrivilege	5028	firefox.exe
Token: SeDebugPrivilege	5028	firefox.exe
Token: SeRestorePrivilege	1112	7zFM.exe
Token: 35	1112	7zFM.exe
Token: SeSecurityPrivilege	1112	7zFM.exe
Token: SeDebugPrivilege	2892	taskmgr.exe
Token: SeSystemProfilePrivilege	2892	taskmgr.exe
Token: SeCreateGlobalPrivilege	2892	taskmgr.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	5468	powershell.exe
Token: SeDebugPrivilege	5896	66ab1b27ae40b_BotClient.exe
Token: SeDebugPrivilege	6004	66ae9b239854c_crypto.exe
Token: SeDebugPrivilege	2012	66b1c36969eae_main.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
1112	7zFM.exe
1112	7zFM.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe
2892	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5028	firefox.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5964	OpenWith.exe
5096	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4856	3932	msedge.exe	81
PID 3932 wrote to memory of 4856	3932	msedge.exe	81
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 1816	3932	msedge.exe	82
PID 3932 wrote to memory of 104	3932	msedge.exe	83
PID 3932 wrote to memory of 104	3932	msedge.exe	83
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84
PID 3932 wrote to memory of 1604	3932	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ufile.io/eobsr3kv
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffbb073cb8,0x7fffbb073cc8,0x7fffbb073cd8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,13954630417686283471,7517369503912301927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7116 /prefetch:2
  2⤵
  PID:6064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4796
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1864 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3f86622-213c-4bfa-909e-88aff03522ea} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" gpu
    3⤵
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2324 -prefMapHandle 2312 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a246d489-dea8-4d45-a5de-68ba792a574c} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" socket
    3⤵
    - Checks processor information in registry
    PID:3432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3200 -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 3216 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74da4b8b-5335-49d4-91c6-4948abb1abe3} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:2652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3404 -childID 2 -isForBrowser -prefsHandle 3864 -prefMapHandle 3860 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ea6f07d-a681-4b6a-87f4-9534f1d523ea} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4824 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4736 -prefMapHandle 4780 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be07b896-276d-4e49-af02-563a1a64042f} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" utility
    3⤵
    - Checks processor information in registry
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 3 -isForBrowser -prefsHandle 5328 -prefMapHandle 5264 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a0f0a8f-e7aa-4726-b60a-a6d8d327cdbc} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 4 -isForBrowser -prefsHandle 5568 -prefMapHandle 5564 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db6d6014-a437-44a1-8c8b-c20f3a73bcb1} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 5 -isForBrowser -prefsHandle 5668 -prefMapHandle 5672 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32a8b131-ebfe-4d23-a145-2d4fda8bf4e6} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6356 -childID 6 -isForBrowser -prefsHandle 6332 -prefMapHandle 6248 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3791dad4-f2f4-4788-b5c8-79da94cebd33} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6524 -childID 7 -isForBrowser -prefsHandle 6344 -prefMapHandle 6304 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8f436f8-95be-406e-b347-443381eda341} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6660 -childID 8 -isForBrowser -prefsHandle 6648 -prefMapHandle 6652 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c355692-f4ff-40c5-9f10-aed38a082c86} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6920 -parentBuildID 20240401114208 -prefsHandle 6912 -prefMapHandle 6908 -prefsLen 29355 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b703b4f-70ef-424e-a91b-75504f4686ff} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" rdd
    3⤵
    PID:5244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6932 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6896 -prefMapHandle 5684 -prefsLen 29355 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08347f84-59cc-4e18-bbf7-e055b8a1461c} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" utility
    3⤵
    - Checks processor information in registry
    PID:5260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5588 -childID 9 -isForBrowser -prefsHandle 5476 -prefMapHandle 5832 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91bc44b1-ba47-4db0-ae37-8bf218ec3429} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6248 -childID 10 -isForBrowser -prefsHandle 7200 -prefMapHandle 5560 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b684fd1-1bad-4ff6-a1e7-144c41b956bd} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7448 -childID 11 -isForBrowser -prefsHandle 6584 -prefMapHandle 4644 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {374e00ee-ef72-45e7-9e57-3e0eb240bec0} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2576 -childID 12 -isForBrowser -prefsHandle 5564 -prefMapHandle 5460 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1036 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd147b14-099f-4592-be17-5cb4ee541a8c} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" tab
    3⤵
    PID:3028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5964
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\saved from malware.7z"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1112

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2892

C:\Users\Admin\Downloads\saved from malware\Files\%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe
"C:\Users\Admin\Downloads\saved from malware\Files\%E4%BA%94%E5%91%B3%E4%BC%A0%E5%A5%87.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2456
- C:\Users\Admin\AppData\Local\Temp\13EB.exe
  "C:\Users\Admin\AppData\Local\Temp\13EB.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\18161440.exe
    C:\Users\Admin\AppData\Local\Temp\18161440.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2700
  - - C:\Windows\sysmysldrv.exe
      C:\Windows\sysmysldrv.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      PID:796
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4688
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5668
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5832
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5864
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\44984851.exe
        
        C:\Users\Admin\AppData\Local\Temp\44984851.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\2737929190.exe
        
        C:\Users\Admin\AppData\Local\Temp\2737929190.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2228

C:\Users\Admin\Downloads\saved from malware\Files\%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe
"C:\Users\Admin\Downloads\saved from malware\Files\%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe"
1⤵
- Executes dropped EXE
PID:5736
- C:\Users\Admin\Downloads\saved from malware\Files\%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe
  "C:\Users\Admin\Downloads\saved from malware\Files\%E5%B0%8F%E9%B8%A1%E5%85%A5%E4%BE%B5%E8%80%853.exe"
  2⤵
  - Executes dropped EXE
  PID:72

C:\Users\Admin\Downloads\saved from malware\Files\1.exe
"C:\Users\Admin\Downloads\saved from malware\Files\1.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6060
- C:\Windows\sysarddrvs.exe
  C:\Windows\sysarddrvs.exe
  2⤵
  - Modifies security service
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: SetClipboardViewer
  PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5512
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5468
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1284
  - - C:\Windows\SysWOW64\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2064
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4316
  - - C:\Windows\SysWOW64\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5428
  - - C:\Windows\SysWOW64\sc.exe
      sc stop DoSvc
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3200
  - - C:\Windows\SysWOW64\sc.exe
      sc stop BITS
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\1410131485.exe
    C:\Users\Admin\AppData\Local\Temp\1410131485.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\2903524228.exe
    C:\Users\Admin\AppData\Local\Temp\2903524228.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1596

C:\Users\Admin\Downloads\saved from malware\Files\4ck3rr.exe
"C:\Users\Admin\Downloads\saved from malware\Files\4ck3rr.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:2364

C:\Users\Admin\Downloads\saved from malware\Files\11.exe
"C:\Users\Admin\Downloads\saved from malware\Files\11.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4380
- C:\Users\Admin\AppData\Local\Temp\6632.exe
  "C:\Users\Admin\AppData\Local\Temp\6632.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5364
- - C:\Users\Admin\AppData\Local\Temp\123034073.exe
    C:\Users\Admin\AppData\Local\Temp\123034073.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5656

C:\Users\Admin\Downloads\saved from malware\Files\66ab1b27ae40b_BotClient.exe
"C:\Users\Admin\Downloads\saved from malware\Files\66ab1b27ae40b_BotClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5896
- C:\Users\Admin\Downloads\saved from malware\Files\66ab1b27ae40b_BotClient.exe
  "C:\Users\Admin\Downloads\saved from malware\Files\66ab1b27ae40b_BotClient.exe"
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Users\Admin\Downloads\saved from malware\Files\66ab1b27ae40b_BotClient.exe
  "C:\Users\Admin\Downloads\saved from malware\Files\66ab1b27ae40b_BotClient.exe"
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Users\Admin\Downloads\saved from malware\Files\66ab1b27ae40b_BotClient.exe
  "C:\Users\Admin\Downloads\saved from malware\Files\66ab1b27ae40b_BotClient.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4452

C:\Users\Admin\Downloads\saved from malware\Files\66ae9b239854c_crypto.exe
"C:\Users\Admin\Downloads\saved from malware\Files\66ae9b239854c_crypto.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5096

C:\Users\Admin\Downloads\saved from malware\Files\66b1c36969eae_main.exe
"C:\Users\Admin\Downloads\saved from malware\Files\66b1c36969eae_main.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:5936
- - C:\ProgramData\DGCFHIDAKE.exe
    "C:\ProgramData\DGCFHIDAKE.exe"
    3⤵
    PID:5148
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1684
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5220
- - C:\ProgramData\HIIIEGDBKJ.exe
    "C:\ProgramData\HIIIEGDBKJ.exe"
    3⤵
    PID:2064
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KJDGIJECFIEB" & exit
    3⤵
    PID:2620
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:5892

C:\Users\Admin\Downloads\saved from malware\Files\66b09d7d34310_DefragManager.exe
"C:\Users\Admin\Downloads\saved from malware\Files\66b09d7d34310_DefragManager.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988
- C:\Users\Admin\AppData\Local\Programs\Defrager Assist Manager\Defrager.exe
  "C:\Users\Admin\AppData\Local\Programs\Defrager Assist Manager\Defrager.exe"
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Programs\Defrager Assist Manager\Defrager.exe"
    3⤵
    PID:9604
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Programs\Defrager Assist Manager\Defrager.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1296
  2⤵
  - Program crash
  PID:1212

C:\Users\Admin\Downloads\saved from malware\Files\1111.exe
"C:\Users\Admin\Downloads\saved from malware\Files\1111.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1552

C:\Users\Admin\Downloads\saved from malware\Files\a.exe
"C:\Users\Admin\Downloads\saved from malware\Files\a.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2148
- C:\Users\Admin\AppData\Local\Temp\8FF1.exe
  "C:\Users\Admin\AppData\Local\Temp\8FF1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5528
- - C:\Users\Admin\AppData\Local\Temp\312335747.exe
    C:\Users\Admin\AppData\Local\Temp\312335747.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3064
- C:\Windows\sysmablsvr.exe
  C:\Windows\sysmablsvr.exe
  2⤵
  - Modifies security service
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: SetClipboardViewer
  PID:5644
- - C:\Users\Admin\AppData\Local\Temp\985D.exe
    "C:\Users\Admin\AppData\Local\Temp\985D.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\214712637.exe
      C:\Users\Admin\AppData\Local\Temp\214712637.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2620
- - C:\Users\Admin\AppData\Local\Temp\1793726670.exe
    C:\Users\Admin\AppData\Local\Temp\1793726670.exe
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\2722518495.exe
    C:\Users\Admin\AppData\Local\Temp\2722518495.exe
    3⤵
    PID:5076

C:\Users\Admin\Downloads\saved from malware\Files\aaa.exe
"C:\Users\Admin\Downloads\saved from malware\Files\aaa.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992
- C:\Users\Admin\AppData\Local\Temp\9495.exe
  "C:\Users\Admin\AppData\Local\Temp\9495.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5516
- - C:\Users\Admin\AppData\Local\Temp\317989421.exe
    C:\Users\Admin\AppData\Local\Temp\317989421.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:824

C:\Users\Admin\Downloads\saved from malware\Files\abc.exe
"C:\Users\Admin\Downloads\saved from malware\Files\abc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1904

C:\Users\Admin\Downloads\saved from malware\Files\amadey.exe
"C:\Users\Admin\Downloads\saved from malware\Files\amadey.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232
- C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1852
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5072
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\110809d565579c\cred64.dll, Main
    3⤵
    PID:1708
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\110809d565579c\cred64.dll, Main
      4⤵
      PID:884
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3868
    - - C:\Windows\system32\tar.exe
        
        tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\610320281626_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"
        5⤵
        
        PID:5992
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\110809d565579c\clip64.dll, Main
    3⤵
    PID:4620

C:\Users\Admin\Downloads\saved from malware\Files\amadey.exe
"C:\Users\Admin\Downloads\saved from malware\Files\amadey.exe"
1⤵
- Executes dropped EXE
PID:2316

C:\Users\Admin\Downloads\saved from malware\Files\build_2024-07-27_00-41.exe
"C:\Users\Admin\Downloads\saved from malware\Files\build_2024-07-27_00-41.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Downloads\saved from malware\Files\build_2024-07-27_00-41.exe" & rd /s /q "C:\ProgramData\HIIIEGDBKJKE" & exit
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 2024
  2⤵
  - Program crash
  PID:5616

C:\Users\Admin\Downloads\saved from malware\Files\ChatLife.exe
"C:\Users\Admin\Downloads\saved from malware\Files\ChatLife.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664
- C:\Users\Admin\AppData\Local\Temp\AA3F.exe
  "C:\Users\Admin\AppData\Local\Temp\AA3F.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\1551127943.exe
    C:\Users\Admin\AppData\Local\Temp\1551127943.exe
    3⤵
    PID:5312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Confirmed Confirmed.cmd & Confirmed.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4200
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4640
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2032
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 768318
    3⤵
    PID:1168
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "PhoneAbcSchedulesApr" Nbc
    3⤵
    PID:5184
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Challenged + Diy + Teachers + California + Mba + Yarn + Payable + Zdnet + Plumbing + Pe + Trick + Betting + Absence + Motorcycles + Man + Analyst + Max + Patrick + Pg + Exemption + Sight 768318\B
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\768318\Paraguay.pif
    768318\Paraguay.pif 768318\B
    3⤵
    PID:1348
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Local\Temp\466504e025\\TradeWise.url" & echo URL="C:\Users\Admin\AppData\Local\TradeInsight Technologies\TradeWise.js" >> "C:\Users\Admin\AppData\Local\Temp\466504e025\\TradeWise.url" & exit
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\768318\Paraguay.pif
      C:\Users\Admin\AppData\Local\Temp\768318\Paraguay.pif
      4⤵
      PID:644
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5
    3⤵
    - Delays execution with timeout.exe
    PID:4920

C:\Users\Admin\Downloads\saved from malware\Files\clear.exe
"C:\Users\Admin\Downloads\saved from malware\Files\clear.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop xadsafev5
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2140
- - C:\Windows\SysWOW64\sc.exe
    sc stop xadsafev5
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete xadsafev5
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4620
- - C:\Windows\SysWOW64\sc.exe
    sc delete xadsafev5
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2084

C:\Users\Admin\Downloads\saved from malware\Files\Crack.exe
"C:\Users\Admin\Downloads\saved from malware\Files\Crack.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708
- C:\Users\Admin\Downloads\saved from malware\Files\Crack.exe
  "C:\Users\Admin\Downloads\saved from malware\Files\Crack.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5528

C:\Users\Admin\Downloads\saved from malware\Files\DelHosts.exe
"C:\Users\Admin\Downloads\saved from malware\Files\DelHosts.exe"
1⤵
PID:3472

C:\Users\Admin\Downloads\saved from malware\Files\Downaqzh.exe
"C:\Users\Admin\Downloads\saved from malware\Files\Downaqzh.exe"
1⤵
PID:1012
- C:\Users\Admin\AppData\Local\Temp\BAF9.exe
  "C:\Users\Admin\AppData\Local\Temp\BAF9.exe"
  2⤵
  PID:4016
- - C:\Users\Admin\AppData\Local\Temp\67319668.exe
    C:\Users\Admin\AppData\Local\Temp\67319668.exe
    3⤵
    PID:2880

C:\Users\Admin\Downloads\saved from malware\Files\Downdd.exe
"C:\Users\Admin\Downloads\saved from malware\Files\Downdd.exe"
1⤵
PID:4420

C:\Users\Admin\Downloads\saved from malware\Files\Downggzh.exe
"C:\Users\Admin\Downloads\saved from malware\Files\Downggzh.exe"
1⤵
PID:2988

C:\Users\Admin\Downloads\saved from malware\Files\DownSysSoft.exe
"C:\Users\Admin\Downloads\saved from malware\Files\DownSysSoft.exe"
1⤵
PID:6088
- C:\Users\Admin\AppData\Local\Temp\C6FF.exe
  "C:\Users\Admin\AppData\Local\Temp\C6FF.exe"
  2⤵
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\823819465.exe
    C:\Users\Admin\AppData\Local\Temp\823819465.exe
    3⤵
    PID:2152

C:\Users\Admin\Downloads\saved from malware\Files\Downty.exe
"C:\Users\Admin\Downloads\saved from malware\Files\Downty.exe"
1⤵
PID:4812

C:\Users\Admin\Downloads\saved from malware\Files\ds.exe
"C:\Users\Admin\Downloads\saved from malware\Files\ds.exe"
1⤵
PID:1600

C:\Users\Admin\Downloads\saved from malware\Files\firefox.exe
"C:\Users\Admin\Downloads\saved from malware\Files\firefox.exe"
1⤵
PID:3356
- C:\Users\Admin\AppData\Local\Temp\D324.exe
  "C:\Users\Admin\AppData\Local\Temp\D324.exe"
  2⤵
  PID:5928
- - C:\Users\Admin\AppData\Local\Temp\2072429056.exe
    C:\Users\Admin\AppData\Local\Temp\2072429056.exe
    3⤵
    PID:4888

C:\Users\Admin\Downloads\saved from malware\Files\guardservice.exe
"C:\Users\Admin\Downloads\saved from malware\Files\guardservice.exe"
1⤵
PID:2032

C:\Users\Admin\Downloads\saved from malware\Files\guardservice.exe
"C:\Users\Admin\Downloads\saved from malware\Files\guardservice.exe"
1⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
1⤵
PID:5552

C:\Users\Admin\Downloads\saved from malware\Files\firefox.exe
"C:\Users\Admin\Downloads\saved from malware\Files\firefox.exe"
1⤵
PID:1820
- C:\Users\Admin\AppData\Local\Temp\F9A8.exe
  "C:\Users\Admin\AppData\Local\Temp\F9A8.exe"
  2⤵
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\2016428434.exe
    C:\Users\Admin\AppData\Local\Temp\2016428434.exe
    3⤵
    PID:5240

C:\Users\Admin\Downloads\saved from malware\Files\firefox.exe
"C:\Users\Admin\Downloads\saved from malware\Files\firefox.exe"
1⤵
PID:4244
- C:\Users\Admin\AppData\Local\Temp\FE4B.exe
  "C:\Users\Admin\AppData\Local\Temp\FE4B.exe"
  2⤵
  PID:5276
- - C:\Users\Admin\AppData\Local\Temp\713732362.exe
    C:\Users\Admin\AppData\Local\Temp\713732362.exe
    3⤵
    PID:3516

C:\Users\Admin\Downloads\saved from malware\Files\firefox.exe
"C:\Users\Admin\Downloads\saved from malware\Files\firefox.exe"
1⤵
PID:5312
- C:\Users\Admin\AppData\Local\Temp\31D.exe
  "C:\Users\Admin\AppData\Local\Temp\31D.exe"
  2⤵
  PID:4068
- - C:\Users\Admin\AppData\Local\Temp\77653676.exe
    C:\Users\Admin\AppData\Local\Temp\77653676.exe
    3⤵
    PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5680 -ip 5680
1⤵
PID:1096

C:\Users\Admin\Downloads\saved from malware\Files\JQMain.exe
"C:\Users\Admin\Downloads\saved from malware\Files\JQMain.exe"
1⤵
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4988 -ip 4988
1⤵
PID:5660

C:\Users\Admin\Downloads\saved from malware\Files\L.exe
"C:\Users\Admin\Downloads\saved from malware\Files\L.exe"
1⤵
PID:5396
- C:\Users\Admin\AppData\Local\Temp\515D.exe
  "C:\Users\Admin\AppData\Local\Temp\515D.exe"
  2⤵
  PID:3428
- - C:\Users\Admin\AppData\Local\Temp\178133452.exe
    C:\Users\Admin\AppData\Local\Temp\178133452.exe
    3⤵
    PID:5664

C:\Users\Admin\Downloads\saved from malware\Files\m.exe
"C:\Users\Admin\Downloads\saved from malware\Files\m.exe"
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\6746.exe
  "C:\Users\Admin\AppData\Local\Temp\6746.exe"
  2⤵
  PID:5452
- - C:\Users\Admin\AppData\Local\Temp\2615921922.exe
    C:\Users\Admin\AppData\Local\Temp\2615921922.exe
    3⤵
    PID:772

C:\Users\Admin\Downloads\saved from malware\Files\M5traider.exe
"C:\Users\Admin\Downloads\saved from malware\Files\M5traider.exe"
1⤵
PID:5380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  PID:1956

C:\Users\Admin\Downloads\saved from malware\Files\Meredrop.exe
"C:\Users\Admin\Downloads\saved from malware\Files\Meredrop.exe"
1⤵
PID:944

C:\Users\Admin\Downloads\saved from malware\Files\mimikatz.exe
"C:\Users\Admin\Downloads\saved from malware\Files\mimikatz.exe"
1⤵
PID:1316
- C:\Users\Admin\AppData\Local\Temp\787C.exe
  "C:\Users\Admin\AppData\Local\Temp\787C.exe"
  2⤵
  PID:3388
- - C:\Users\Admin\AppData\Local\Temp\147023288.exe
    C:\Users\Admin\AppData\Local\Temp\147023288.exe
    3⤵
    PID:5764

C:\Users\Admin\Downloads\saved from malware\Files\nc.exe
"C:\Users\Admin\Downloads\saved from malware\Files\nc.exe"
1⤵
PID:1836

C:\Users\Admin\Downloads\saved from malware\Files\newtpp.exe
"C:\Users\Admin\Downloads\saved from malware\Files\newtpp.exe"
1⤵
PID:5260
- C:\Users\Admin\AppData\Local\Temp\A0C5.exe
  "C:\Users\Admin\AppData\Local\Temp\A0C5.exe"
  2⤵
  PID:3088
- - C:\Users\Admin\AppData\Local\Temp\170084250.exe
    C:\Users\Admin\AppData\Local\Temp\170084250.exe
    3⤵
    PID:5492

C:\Users\Admin\Downloads\saved from malware\Files\npp.exe
"C:\Users\Admin\Downloads\saved from malware\Files\npp.exe"
1⤵
PID:2028
- C:\Users\Admin\AppData\Local\Temp\A72D.exe
  "C:\Users\Admin\AppData\Local\Temp\A72D.exe"
  2⤵
  PID:3428
- - C:\Users\Admin\AppData\Local\Temp\16189860.exe
    C:\Users\Admin\AppData\Local\Temp\16189860.exe
    3⤵
    PID:5744
- C:\Users\Admin\AppData\Local\Temp\233459657.exe
  C:\Users\Admin\AppData\Local\Temp\233459657.exe
  2⤵
  PID:4800

C:\Users\Admin\Downloads\saved from malware\Files\o.exe
"C:\Users\Admin\Downloads\saved from malware\Files\o.exe"
1⤵
PID:4360

C:\Users\Admin\Downloads\saved from malware\Files\o.exe
"C:\Users\Admin\Downloads\saved from malware\Files\o.exe"
1⤵
PID:2408

C:\Users\Admin\Downloads\saved from malware\Files\pei.exe
"C:\Users\Admin\Downloads\saved from malware\Files\pei.exe"
1⤵
PID:2232
- C:\Users\Admin\AppData\Local\Temp\2667331292.exe
  C:\Users\Admin\AppData\Local\Temp\2667331292.exe
  2⤵
  PID:9740

C:\Users\Admin\Downloads\saved from malware\Files\peinf.exe
"C:\Users\Admin\Downloads\saved from malware\Files\peinf.exe"
1⤵
PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 23324
  2⤵
  - Program crash
  PID:10232

C:\Users\Admin\Downloads\saved from malware\Files\pered.exe
"C:\Users\Admin\Downloads\saved from malware\Files\pered.exe"
1⤵
PID:1816
- C:\Users\Admin\Downloads\saved from malware\Files\pered.exe
  "C:\Users\Admin\Downloads\saved from malware\Files\pered.exe"
  2⤵
  PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4800

C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
1⤵
PID:9704

C:\Users\Admin\Downloads\saved from malware\Files\pi.exe
"C:\Users\Admin\Downloads\saved from malware\Files\pi.exe"
1⤵
PID:9752
- C:\Windows\sylsplvc.exe
  C:\Windows\sylsplvc.exe
  2⤵
  PID:9916
- - C:\Users\Admin\AppData\Local\Temp\3134413156.exe
    C:\Users\Admin\AppData\Local\Temp\3134413156.exe
    3⤵
    PID:7188
- - C:\Users\Admin\AppData\Local\Temp\294033554.exe
    C:\Users\Admin\AppData\Local\Temp\294033554.exe
    3⤵
    PID:7904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3328 -ip 3328
1⤵
PID:10212

C:\Users\Admin\Downloads\saved from malware\Files\pimer_bbbcontents7.exe
"C:\Users\Admin\Downloads\saved from malware\Files\pimer_bbbcontents7.exe"
1⤵
PID:6688
- C:\Users\Admin\Downloads\saved from malware\Files\pimer_bbbcontents7.exe
  "C:\Users\Admin\Downloads\saved from malware\Files\pimer_bbbcontents7.exe"
  2⤵
  PID:6640
- C:\Users\Admin\Downloads\saved from malware\Files\pimer_bbbcontents7.exe
  "C:\Users\Admin\Downloads\saved from malware\Files\pimer_bbbcontents7.exe"
  2⤵
  PID:6632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 1340
    3⤵
    - Program crash
    PID:8892

C:\Users\Admin\Downloads\saved from malware\Files\pocketrar350sc.exe
"C:\Users\Admin\Downloads\saved from malware\Files\pocketrar350sc.exe"
1⤵
PID:6928

C:\Users\Admin\Downloads\saved from malware\Files\pp.exe
"C:\Users\Admin\Downloads\saved from malware\Files\pp.exe"
1⤵
PID:7468

C:\Users\Admin\Downloads\saved from malware\Files\Project_8.exe
"C:\Users\Admin\Downloads\saved from malware\Files\Project_8.exe"
1⤵
PID:7760
- C:\Users\Admin\AppData\Local\Temp\648b5vt13485v134322685vt.exe
  "C:\Users\Admin\AppData\Local\Temp\648b5vt13485v134322685vt.exe"
  2⤵
  PID:7936

C:\Users\Admin\Downloads\saved from malware\Files\ps.exe
"C:\Users\Admin\Downloads\saved from malware\Files\ps.exe"
1⤵
PID:7832

C:\Users\Admin\Downloads\saved from malware\Files\PXHMAIN.exe
"C:\Users\Admin\Downloads\saved from malware\Files\PXHMAIN.exe"
1⤵
PID:7968

C:\Users\Admin\Downloads\saved from malware\Files\r.exe
"C:\Users\Admin\Downloads\saved from malware\Files\r.exe"
1⤵
PID:8096

C:\Users\Admin\Downloads\saved from malware\Files\random.exe
"C:\Users\Admin\Downloads\saved from malware\Files\random.exe"
1⤵
PID:8160
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  PID:8260

C:\Users\Admin\Downloads\saved from malware\Files\random.exe
"C:\Users\Admin\Downloads\saved from malware\Files\random.exe"
1⤵
PID:8208

C:\Users\Admin\Downloads\saved from malware\Files\request.exe
"C:\Users\Admin\Downloads\saved from malware\Files\request.exe"
1⤵
PID:8372
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8468
- C:\Users\Admin\msvcservice.exe
  "C:\Users\Admin\msvcservice.exe"
  2⤵
  PID:8544
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8636

C:\Users\Admin\Downloads\saved from malware\Files\s.exe
"C:\Users\Admin\Downloads\saved from malware\Files\s.exe"
1⤵
PID:8448

C:\Users\Admin\Downloads\saved from malware\Files\SvCpJuhbT.exe
"C:\Users\Admin\Downloads\saved from malware\Files\SvCpJuhbT.exe"
1⤵
PID:8816
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\SysWOW64\notepad.exe"
  2⤵
  PID:9112
- - C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe
    "C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
    3⤵
    PID:9136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6632 -ip 6632
1⤵
PID:8876

C:\Users\Admin\Downloads\saved from malware\Files\SvCpJuhbT.exe
"C:\Users\Admin\Downloads\saved from malware\Files\SvCpJuhbT.exe"
1⤵
PID:8948
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\SysWOW64\notepad.exe"
  2⤵
  PID:9168
- - C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe
    "C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
    3⤵
    PID:9200
- - C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe
    "C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe"
    3⤵
    PID:9208

C:\Users\Admin\Downloads\saved from malware\Files\t.exe
"C:\Users\Admin\Downloads\saved from malware\Files\t.exe"
1⤵
PID:9064

C:\Users\Admin\Downloads\saved from malware\Files\t.exe
"C:\Users\Admin\Downloads\saved from malware\Files\t.exe"
1⤵
PID:6504

C:\Users\Admin\Downloads\saved from malware\Files\t1.exe
"C:\Users\Admin\Downloads\saved from malware\Files\t1.exe"
1⤵
PID:6584

C:\Users\Admin\Downloads\saved from malware\Files\t1.exe
"C:\Users\Admin\Downloads\saved from malware\Files\t1.exe"
1⤵
PID:6604

C:\Users\Admin\Downloads\saved from malware\Files\t2.exe
"C:\Users\Admin\Downloads\saved from malware\Files\t2.exe"
1⤵
PID:256

C:\Users\Admin\Downloads\saved from malware\Files\tdrpload.exe
"C:\Users\Admin\Downloads\saved from malware\Files\tdrpload.exe"
1⤵
PID:4812

C:\Users\Admin\Downloads\saved from malware\Files\tools.exe
"C:\Users\Admin\Downloads\saved from malware\Files\tools.exe"
1⤵
PID:2756

C:\Users\Admin\Downloads\saved from malware\Files\tpeinf.exe
"C:\Users\Admin\Downloads\saved from malware\Files\tpeinf.exe"
1⤵
PID:4280
- C:\Users\Admin\AppData\Local\Temp\1237323282.exe
  C:\Users\Admin\AppData\Local\Temp\1237323282.exe
  2⤵
  PID:9220

C:\Users\Admin\Downloads\saved from malware\Files\tt.exe
"C:\Users\Admin\Downloads\saved from malware\Files\tt.exe"
1⤵
PID:1404

C:\Users\Admin\Downloads\saved from malware\Files\twztl.exe
"C:\Users\Admin\Downloads\saved from malware\Files\twztl.exe"
1⤵
PID:5512

C:\Users\Admin\Downloads\saved from malware\Files\v.exe
"C:\Users\Admin\Downloads\saved from malware\Files\v.exe"
1⤵
PID:9280
- C:\Users\Admin\winsvc.exe
  C:\Users\Admin\winsvc.exe
  2⤵
  PID:9580

C:\Users\Admin\Downloads\saved from malware\Files\xmrig.exe
"C:\Users\Admin\Downloads\saved from malware\Files\xmrig.exe"
1⤵
PID:9340

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:10112

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\c94c058d171b490f9588c8ad8e5b0a67 /t 6932 /p 6928
1⤵
PID:10128

C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
1⤵
PID:8504

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:6760
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6672

C:\Users\Admin\Downloads\saved from malware\a\66ae96cb3d23b_crypted.exe
"C:\Users\Admin\Downloads\saved from malware\a\66ae96cb3d23b_crypted.exe"
1⤵
PID:680
- C:\Users\Admin\AppData\Local\Temp\E4DE.exe
  "C:\Users\Admin\AppData\Local\Temp\E4DE.exe"
  2⤵
  PID:7412
- - C:\Users\Admin\AppData\Local\Temp\2332413198.exe
    C:\Users\Admin\AppData\Local\Temp\2332413198.exe
    3⤵
    PID:3812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7436

C:\Users\Admin\Downloads\saved from malware\a\66af9bdbf0f60_Team.exe
"C:\Users\Admin\Downloads\saved from malware\a\66af9bdbf0f60_Team.exe"
1⤵
PID:7464
- C:\Users\Admin\AppData\Local\Temp\F420.exe
  "C:\Users\Admin\AppData\Local\Temp\F420.exe"
  2⤵
  PID:8016
- - C:\Users\Admin\AppData\Local\Temp\3079125953.exe
    C:\Users\Admin\AppData\Local\Temp\3079125953.exe
    3⤵
    PID:8312

C:\Users\Admin\Downloads\saved from malware\a\66afa0d3934d8_ultfix.exe
"C:\Users\Admin\Downloads\saved from malware\a\66afa0d3934d8_ultfix.exe"
1⤵
PID:8248
- C:\Users\Admin\AppData\Local\Temp\640.exe
  "C:\Users\Admin\AppData\Local\Temp\640.exe"
  2⤵
  PID:5960
- - C:\Users\Admin\AppData\Local\Temp\221368494.exe
    C:\Users\Admin\AppData\Local\Temp\221368494.exe
    3⤵
    PID:8380

C:\Users\Admin\Downloads\saved from malware\a\66b0ee142cf8f_PhotosExifEditor.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b0ee142cf8f_PhotosExifEditor.exe"
1⤵
PID:8624
- C:\Users\Admin\AppData\Local\Temp\1851.exe
  "C:\Users\Admin\AppData\Local\Temp\1851.exe"
  2⤵
  PID:8668
- - C:\Users\Admin\AppData\Local\Temp\1080523444.exe
    C:\Users\Admin\AppData\Local\Temp\1080523444.exe
    3⤵
    PID:8824

C:\Users\Admin\Downloads\saved from malware\a\66b0ee142cf8f_PhotosExifEditor.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b0ee142cf8f_PhotosExifEditor.exe"
1⤵
PID:8760
- C:\Users\Admin\AppData\Local\Temp\1C68.exe
  "C:\Users\Admin\AppData\Local\Temp\1C68.exe"
  2⤵
  PID:8780
- - C:\Users\Admin\AppData\Local\Temp\1682826811.exe
    C:\Users\Admin\AppData\Local\Temp\1682826811.exe
    3⤵
    PID:2788

C:\Users\Admin\Downloads\saved from malware\a\66b0ee142cf8f_PhotosExifEditor.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b0ee142cf8f_PhotosExifEditor.exe"
1⤵
PID:3196
- C:\Users\Admin\AppData\Local\Temp\1DD0.exe
  "C:\Users\Admin\AppData\Local\Temp\1DD0.exe"
  2⤵
  PID:8896
- - C:\Users\Admin\AppData\Local\Temp\1963027986.exe
    C:\Users\Admin\AppData\Local\Temp\1963027986.exe
    3⤵
    PID:3476

C:\Users\Admin\Downloads\saved from malware\a\66b0ee142cf8f_PhotosExifEditor.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b0ee142cf8f_PhotosExifEditor.exe"
1⤵
PID:6864
- C:\Users\Admin\AppData\Local\Temp\1ED9.exe
  "C:\Users\Admin\AppData\Local\Temp\1ED9.exe"
  2⤵
  PID:8852
- - C:\Users\Admin\AppData\Local\Temp\1981929211.exe
    C:\Users\Admin\AppData\Local\Temp\1981929211.exe
    3⤵
    PID:388

C:\Users\Admin\Downloads\saved from malware\a\66b4af430a0a1_files.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b4af430a0a1_files.exe"
1⤵
PID:8952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:8408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:256

C:\Users\Admin\Downloads\saved from malware\a\66b4b5e40dbf6_template832components.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b4b5e40dbf6_template832components.exe"
1⤵
PID:3764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5080

C:\Users\Admin\Downloads\saved from malware\a\66b4ed2ceb0d7_stealc.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b4ed2ceb0d7_stealc.exe"
1⤵
PID:4604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:9492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 9492 -s 740
    3⤵
    - Program crash
    PID:6868

C:\Users\Admin\Downloads\saved from malware\a\66b5ac957cc65_crypta.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b5ac957cc65_crypta.exe"
1⤵
PID:9508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:9796

C:\Users\Admin\Downloads\saved from malware\a\66b5ac1092454_otraba.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b5ac1092454_otraba.exe"
1⤵
PID:10024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2472

C:\Users\Admin\Downloads\saved from malware\a\66b5ace3a06b0_dozkey.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b5ace3a06b0_dozkey.exe"
1⤵
PID:7648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:7248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:7692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GCGCBAECFCAK" & exit
    3⤵
    PID:8272
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:5124

C:\Users\Admin\Downloads\saved from malware\a\66b5b75106ac6_stealc.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b5b75106ac6_stealc.exe"
1⤵
PID:7268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:8068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:8100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5556

C:\Users\Admin\Downloads\saved from malware\a\66b5d9d3adbaa_defaultr.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b5d9d3adbaa_defaultr.exe"
1⤵
PID:4828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:6316

C:\Users\Admin\Downloads\saved from malware\a\66b7a2aef1283_doz.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b7a2aef1283_doz.exe"
1⤵
PID:8108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:6840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5328

C:\Users\Admin\Downloads\saved from malware\a\66b7a4a075311_AsianAsp.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b7a4a075311_AsianAsp.exe"
1⤵
PID:9092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Everybody Everybody.cmd && Everybody.cmd && exit
  2⤵
  PID:6520
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6996
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    PID:7140

C:\Users\Admin\Downloads\saved from malware\a\66b7d3a2e7a4d_deepweb.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b7d3a2e7a4d_deepweb.exe"
1⤵
PID:3728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6204
- - C:\Users\Admin\AppData\Local\Temp\elton.exe
    "C:\Users\Admin\AppData\Local\Temp\elton.exe"
    3⤵
    PID:4864
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:8180
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:8196
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:8292
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Roaming\6IPnnV4wtJ.exe
        
        "C:\Users\Admin\AppData\Roaming\6IPnnV4wtJ.exe"
        6⤵
        
        PID:6760
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Roaming\A9QgNlZpNl.exe
        
        "C:\Users\Admin\AppData\Roaming\A9QgNlZpNl.exe"
        6⤵
        
        PID:10016
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:7868

C:\Users\Admin\Downloads\saved from malware\a\66b7d12b3a8ea_5k.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b7d12b3a8ea_5k.exe"
1⤵
PID:9276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10076
- - C:\Users\Admin\AppData\Roaming\Q6XuxrkAPa.exe
    "C:\Users\Admin\AppData\Roaming\Q6XuxrkAPa.exe"
    3⤵
    PID:5416
- - C:\Users\Admin\AppData\Roaming\3td9eNGuA3.exe
    "C:\Users\Admin\AppData\Roaming\3td9eNGuA3.exe"
    3⤵
    PID:6624

C:\Users\Admin\Downloads\saved from malware\a\66b38b9ae0da3_palnet_new.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b38b9ae0da3_palnet_new.exe"
1⤵
PID:3512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:7520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:7504

C:\Users\Admin\Downloads\saved from malware\a\66b74da9b163e_1234.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b74da9b163e_1234.exe"
1⤵
PID:7764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:8156

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:7852

C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
1⤵
PID:8056

C:\Users\Admin\Downloads\saved from malware\a\66b85f47d1f63_stealc.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b85f47d1f63_stealc.exe"
1⤵
PID:6156
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:9560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2844

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:2112

C:\Users\Admin\Downloads\saved from malware\a\66b382f122c02_stk.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b382f122c02_stk.exe"
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 9492 -ip 9492
1⤵
PID:6532

C:\Users\Admin\Downloads\saved from malware\a\66b331646d2cd_123p.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b331646d2cd_123p.exe"
1⤵
PID:8876
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:10132
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:6756
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:3936
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:9588
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe delete "VIFLJRPW"
  2⤵
  - Launches sc.exe
  PID:8344
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe create "VIFLJRPW" binpath= "C:\ProgramData\xprfjygruytr\etzpikspwykg.exe" start= "auto"
  2⤵
  - Launches sc.exe
  PID:8952
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop eventlog
  2⤵
  - Launches sc.exe
  PID:1804
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe start "VIFLJRPW"
  2⤵
  - Launches sc.exe
  PID:3080

C:\Users\Admin\Downloads\saved from malware\a\66b331997e05e_main21.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b331997e05e_main21.exe"
1⤵
PID:5664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:7176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:7732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2476

C:\Users\Admin\Downloads\saved from malware\a\66b38609432fa_sosusion.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b38609432fa_sosusion.exe"
1⤵
PID:3340
- C:\Users\Admin\AppData\Local\Temp\乎䥒R
  "C:\Users\Admin\AppData\Local\Temp\乎䥒R"
  2⤵
  PID:5516

C:\Users\Admin\Downloads\saved from malware\a\66b837290469c_vidar.exe
"C:\Users\Admin\Downloads\saved from malware\a\66b837290469c_vidar.exe"
1⤵
PID:3352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:8180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:7880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:6160

C:\Users\Admin\Downloads\saved from malware\a\1111.exe
"C:\Users\Admin\Downloads\saved from malware\a\1111.exe"
1⤵
PID:8092
- C:\Users\Admin\AppData\Local\Temp\F9C8.exe
  "C:\Users\Admin\AppData\Local\Temp\F9C8.exe"
  2⤵
  PID:8536
- - C:\Users\Admin\AppData\Local\Temp\767819505.exe
    C:\Users\Admin\AppData\Local\Temp\767819505.exe
    3⤵
    PID:1888

C:\Users\Admin\Downloads\saved from malware\a\ApertureLab.exe
"C:\Users\Admin\Downloads\saved from malware\a\ApertureLab.exe"
1⤵
PID:6508
- C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe
  "C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe"
  2⤵
  PID:9792

C:\Users\Admin\Downloads\saved from malware\a\asusns.exe
"C:\Users\Admin\Downloads\saved from malware\a\asusns.exe"
1⤵
PID:1760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OKmzKrla.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7836
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OKmzKrla" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6340.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7704
- C:\Users\Admin\Downloads\saved from malware\a\asusns.exe
  "C:\Users\Admin\Downloads\saved from malware\a\asusns.exe"
  2⤵
  PID:8484

C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
1⤵
PID:8564
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:6492
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:9456
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:9856
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:9504
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:9464
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:9436

C:\Users\Admin\Downloads\saved from malware\a\authenticator.exe
"C:\Users\Admin\Downloads\saved from malware\a\authenticator.exe"
1⤵
PID:9264

C:\Users\Admin\Downloads\saved from malware\a\backdoor.exe
"C:\Users\Admin\Downloads\saved from malware\a\backdoor.exe"
1⤵
PID:9732

C:\Users\Admin\Downloads\saved from malware\a\build2.exe
"C:\Users\Admin\Downloads\saved from malware\a\build2.exe"
1⤵
PID:2720

C:\Users\Admin\Downloads\saved from malware\a\c7.exe
"C:\Users\Admin\Downloads\saved from malware\a\c7.exe"
1⤵
PID:1796

C:\Users\Admin\Downloads\saved from malware\a\cookie250.exe
"C:\Users\Admin\Downloads\saved from malware\a\cookie250.exe"
1⤵
PID:10012

C:\Users\Admin\Downloads\saved from malware\a\cookie250.exe
"C:\Users\Admin\Downloads\saved from malware\a\cookie250.exe"
1⤵
PID:7248

C:\Users\Admin\Downloads\saved from malware\a\cookie250.exe
"C:\Users\Admin\Downloads\saved from malware\a\cookie250.exe"
1⤵
PID:828

C:\Users\Admin\Downloads\saved from malware\a\exec.exe
"C:\Users\Admin\Downloads\saved from malware\a\exec.exe"
1⤵
PID:10128

C:\Users\Admin\Downloads\saved from malware\a\Extreme%20Injector%20v3.exe
"C:\Users\Admin\Downloads\saved from malware\a\Extreme%20Injector%20v3.exe"
1⤵
PID:6616

C:\Users\Admin\Downloads\saved from malware\a\Extreme%20Injector%20v3.exe
"C:\Users\Admin\Downloads\saved from malware\a\Extreme%20Injector%20v3.exe"
1⤵
PID:8188

C:\Users\Admin\Downloads\saved from malware\a\Extreme%20Injector%20v3.exe
"C:\Users\Admin\Downloads\saved from malware\a\Extreme%20Injector%20v3.exe"
1⤵
PID:7716

C:\Users\Admin\Downloads\saved from malware\a\GGWS.exe
"C:\Users\Admin\Downloads\saved from malware\a\GGWS.exe"
1⤵
PID:560

C:\Users\Admin\Downloads\saved from malware\a\GGWSUpdate.exe
"C:\Users\Admin\Downloads\saved from malware\a\GGWSUpdate.exe"
1⤵
PID:7412

C:\Users\Admin\Downloads\saved from malware\a\Identifications.exe
"C:\Users\Admin\Downloads\saved from malware\a\Identifications.exe"
1⤵
PID:1492

C:\Users\Admin\Downloads\saved from malware\a\InstallerPack_20.1.23770_win64.exe
"C:\Users\Admin\Downloads\saved from malware\a\InstallerPack_20.1.23770_win64.exe"
1⤵
PID:9172

C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
1⤵
PID:7556

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:9304

C:\Users\Admin\Downloads\saved from malware\a\InstallerPack_20.1.23770_win64.exe
"C:\Users\Admin\Downloads\saved from malware\a\InstallerPack_20.1.23770_win64.exe"
1⤵
PID:9716

C:\Users\Admin\Downloads\saved from malware\a\keylogger.exe
"C:\Users\Admin\Downloads\saved from malware\a\keylogger.exe"
1⤵
PID:6256

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:8164

C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\466504e025\Utsysc.exe
1⤵
PID:3960

C:\Users\Admin\Downloads\saved from malware\a\l2.exe
"C:\Users\Admin\Downloads\saved from malware\a\l2.exe"
1⤵
PID:3088
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5380

C:\Users\Admin\Downloads\saved from malware\a\mservice64.exe
"C:\Users\Admin\Downloads\saved from malware\a\mservice64.exe"
1⤵
PID:5124

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:9552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery