crimsonrat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
159s
max time network
305s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-10-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

Processes:

resource	yara_rule
C:\ProgramData\Hdlharas\dlrarhsiva.exe	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

winupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewmsncs.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe \"C:\\Windows\\Fonts\\wmsncs.exe\""	wmsncs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

wmsncs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	wmsncs.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	wmsncs.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	wmsncs.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

wmsncs.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" wmsncs.exe
Modiloader family
modiloader
Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	wmsncs.exe

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerunonce.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	4920	4420	rundll32.exe	WINWORD.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	10056	10168	runonce.exe	WINWORD.EXE

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

wmsncs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wmsncs.exe

Contacts a large (3034) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\NetWire.gm1piRxC.exe.part	modiloader_stage1

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/7784-16794-0x0000000002030000-0x0000000002058000-memory.dmp	rezer0

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

wmsncs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{103L3C30-C3B3-4130-9363-E59E1375PERM}	wmsncs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{103L3C30-C3B3-4130-9363-E59E1375PERM}\StubPath = "C:\\Windows\\Fonts\\wmsncs.exe"	wmsncs.exe

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

Kobalc.exewmsncs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	Kobalc.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	wmsncs.exe

Modifies Windows Firewall 2 TTPs 6 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

10916 netsh.exe
892 netsh.exe
2448 netsh.exe
1044 netsh.exe
1860 netsh.exe
656 netsh.exe

pid	process
10916	netsh.exe
892	netsh.exe
2448	netsh.exe
1044	netsh.exe
1860	netsh.exe
656	netsh.exe

Office macro that triggers on suspicious action 2 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\metrofax.doc	office_macro_on_action
C:\Users\Admin\Downloads\NetWire.cJidlDo2.doc.part	office_macro_on_action

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
6596	attrib.exe
7876	attrib.exe
9624	attrib.exe
10596	attrib.exe
9316	attrib.exe
9440	attrib.exe
10268	attrib.exe
6436	attrib.exe
3432	attrib.exe
4540	attrib.exe
3492	attrib.exe
10744	attrib.exe
5704	attrib.exe
7500	attrib.exe
9380	attrib.exe
3212	attrib.exe
5544	attrib.exe
9268	attrib.exe
3576	attrib.exe
9000	attrib.exe
5816	attrib.exe
3568	attrib.exe
8876	attrib.exe
4984	attrib.exe
4864	attrib.exe
10288	attrib.exe
656	attrib.exe
3568	attrib.exe
3808	attrib.exe
7380	attrib.exe
7252	attrib.exe
2480	attrib.exe
4840	attrib.exe
6084	attrib.exe
8640	attrib.exe
8268	attrib.exe
10724	attrib.exe
7392	attrib.exe
8012	attrib.exe
3980	attrib.exe
5212	attrib.exe
7324	attrib.exe
3568	attrib.exe
3492	attrib.exe
4504	attrib.exe
3900	attrib.exe
7204	attrib.exe
9164	attrib.exe
5492	attrib.exe
8512	attrib.exe
976	attrib.exe
9320	attrib.exe
5224	attrib.exe
8136	attrib.exe
2220	attrib.exe
11200	attrib.exe
4380	attrib.exe
8592	attrib.exe
9748	attrib.exe
3788	attrib.exe
4428	attrib.exe
8060	attrib.exe
1132	attrib.exe
7676	attrib.exe

Executes dropped EXE 23 IoCs

Processes:

Blaster.E.exeKobalc.exewmsncs.exeRahack.exeSasser.A.exeRahack.exeEternalRocks.exeOpaserv.l.exemsload.exe8tr.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

pid	process
472	Blaster.E.exe
1780	Kobalc.exe
2284	wmsncs.exe
3412	Rahack.exe
3716	Sasser.A.exe
3912	Rahack.exe
3236	EternalRocks.exe
4028	Opaserv.l.exe
3244	msload.exe
3888	8tr.exe
1560	Blackkomet.exe
2024	winupdate.exe
2480	winupdate.exe
3900	winupdate.exe
3760	winupdate.exe
3644	winupdate.exe
2312	winupdate.exe
3084	winupdate.exe
3400	winupdate.exe
2448	winupdate.exe
3544	winupdate.exe
4032	winupdate.exe
3840	winupdate.exe

Loads dropped DLL 51 IoCs

Processes:

WerFault.exeOpaserv.l.exeWINWORD.EXEBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

pid	process
3764	WerFault.exe
3764	WerFault.exe
3764	WerFault.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
3980	WINWORD.EXE
1560	Blackkomet.exe
2024	winupdate.exe
2024	winupdate.exe
2024	winupdate.exe
2024	winupdate.exe
2480	winupdate.exe
2480	winupdate.exe
2480	winupdate.exe
2480	winupdate.exe
3900	winupdate.exe
3900	winupdate.exe
3900	winupdate.exe
3900	winupdate.exe
3760	winupdate.exe
3760	winupdate.exe
3760	winupdate.exe
3760	winupdate.exe
3644	winupdate.exe
3644	winupdate.exe
3644	winupdate.exe
3644	winupdate.exe
2312	winupdate.exe
2312	winupdate.exe
2312	winupdate.exe
2312	winupdate.exe
3084	winupdate.exe
3084	winupdate.exe
3084	winupdate.exe
3084	winupdate.exe
3400	winupdate.exe
2448	winupdate.exe
2448	winupdate.exe
2448	winupdate.exe
2448	winupdate.exe
3544	winupdate.exe
3544	winupdate.exe
3544	winupdate.exe
3544	winupdate.exe
4032	winupdate.exe
4032	winupdate.exe
4032	winupdate.exe
4032	winupdate.exe
3840	winupdate.exe
3840	winupdate.exe
3840	winupdate.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

wmsncs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wmsncs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wmsncs.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

8tr.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	8tr.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

8tr.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	8tr.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	8tr.exe
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	8tr.exe

Adds Run key to start application 2 TTPs 39 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Opaserv.l.exewmsncs.exenotepad.exenotepad.exewinupdate.exenotepad.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exenotepad.exewinupdate.exenotepad.exewinupdate.exewinupdate.exeBlackkomet.exenotepad.exewinupdate.exewinupdate.exenotepad.exewinupdate.exenotepad.exeBlaster.E.exenotepad.exenotepad.exewinupdate.exenotepad.exenotepad.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\C_28592 = "C:\\WINDOWS\\C_28592.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Wmsncs Service = "C:\\Windows\\Fonts\\wmsncs.exe"	wmsncs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Wins Service = "C:\\Windows\\system32\\wins\\wmsncs.exe"	wmsncs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NvidMediaCenter = "C:\\Program Files (x86)\\Common Files\\System\\wmsncs.exe"	wmsncs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\C_1148 = "C:\\WINDOWS\\C_1148.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\DHCPCORE6 = "C:\\WINDOWS\\DHCPCORE6.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Spool Driver Service = "C:\\Windows\\system32\\spool\\drivers\\wmsncs.exe"	wmsncs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CPFILTERS = "C:\\WINDOWS\\CPFILTERS.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Automation = "mslaugh.exe"	Blaster.E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\D3DCOMPILER_47 = "C:\\WINDOWS\\D3DCOMPILER_47.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	Opaserv.l.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

Processes:

flow	ioc
62	raw.githubusercontent.com
63	raw.githubusercontent.com
64	raw.githubusercontent.com
67	raw.githubusercontent.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com
3120	0.tcp.ngrok.io
3281	0.tcp.ngrok.io
3769	0.tcp.ngrok.io
3908	0.tcp.ngrok.io
68	raw.githubusercontent.com
69	raw.githubusercontent.com
3412	pastebin.com
3474	0.tcp.ngrok.io
3049	0.tcp.ngrok.io
3409	pastebin.com
3620	0.tcp.ngrok.io

Drops file in System32 directory 64 IoCs

Processes:

notepad.exewinupdate.exewinupdate.exeattrib.exenotepad.exeattrib.exewinupdate.exewinupdate.exeattrib.exenotepad.exeattrib.exeattrib.exenotepad.exenotepad.exenotepad.exeattrib.exewinupdate.exewinupdate.exewmsncs.exewinupdate.exewinupdate.exenotepad.exeattrib.exeattrib.exewinupdate.exeattrib.exeattrib.exeattrib.exeattrib.exenotepad.exeattrib.exeattrib.exenotepad.exeBlackkomet.exewinupdate.exeattrib.exewinupdate.exeattrib.exewinupdate.exenotepad.exeattrib.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wmsncs.exe
File created	C:\Windows\system32\spool\drivers\wmsncs.exe	wmsncs.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\wins\wmsncs.exe	wmsncs.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe\:Zone.Identifier:$DATA	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\wins\wmsncs.exe	wmsncs.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3888-1238-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

Processes:

wmsncs.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\System	wmsncs.exe
File created	C:\Program Files (x86)\Common Files\System\wmsncs.exe	wmsncs.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\wmsncs.exe	wmsncs.exe
File created	C:\Program Files (x86)\Common Files\System\wmsncs.exe\:Zone.Identifier:$DATA	wmsncs.exe

Drops file in Windows directory 27 IoCs

Processes:

Opaserv.l.exemsload.exeKobalc.exe

description	ioc	process
File created	\??\c:\windows\system\scr.scr	Opaserv.l.exe
File created	C:\WINDOWS\C_28592.EXE	Opaserv.l.exe
File opened for modification	C:\Windows\MSBIND.DLL	Opaserv.l.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	C:\WINDOWS\MPREXE.EXE	Opaserv.l.exe
File opened for modification	\??\c:\windows\system\scr.scr	Opaserv.l.exe
File opened for modification	C:\WINDOWS\CPFILTERS.EXE	Opaserv.l.exe
File created	C:\WINDOWS\C_1148.EXE	Opaserv.l.exe
File created	C:\WINDOWS\D3DCOMPILER_47.EXE	Opaserv.l.exe
File opened for modification	C:\WINDOWS\C_1148.EXE	Opaserv.l.exe
File opened for modification	\??\c:\windows\system\scr.scr	msload.exe
File created	\??\c:\windows\system\msload.exe	Opaserv.l.exe
File created	C:\Windows\Fonts\wmsncs.exe\:Zone.Identifier:$DATA	Kobalc.exe
File opened for modification	\??\c:\windows\system\msload.exe	Opaserv.l.exe
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	Opaserv.l.exe
File created	\??\c:\windows\system\winsrv.exe	Opaserv.l.exe
File created	C:\WINDOWS\CPFILTERS.EXE	Opaserv.l.exe
File opened for modification	C:\WINDOWS\C_28592.EXE	Opaserv.l.exe
File opened for modification	C:\WINDOWS\D3DCOMPILER_47.EXE	Opaserv.l.exe
File created	C:\Windows\Fonts\wmsncs.exe	Kobalc.exe
File created	C:\WINDOWS\MPREXE.EXE	Opaserv.l.exe
File opened for modification	C:\WINDOWS\DHCPCORE6.EXE	Opaserv.l.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File opened for modification	C:\Windows\Fonts\wmsncs.exe	Kobalc.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	Opaserv.l.exe
File created	C:\WINDOWS\DHCPCORE6.EXE	Opaserv.l.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 9 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\CodeRed.a.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\EternalRocks.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Opaserv.l.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Rahack.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Kobalc.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Sasser.A.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Adwind.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Blackkomet.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Blaster.E.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3764 3716 WerFault.exe Sasser.A.exe

pid	pid_target	process	target process
3764	3716	WerFault.exe	Sasser.A.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

NET.exeNET.exeattrib.exenet1.exeNET.exeNET.exenet1.exeattrib.exenotepad.exenetsh.exenet1.exenet1.exeNET.exenet1.exeNET.exenet1.exeNET.exenet1.exenotepad.exenet1.exenotepad.exeattrib.exenetsh.exenet1.exenet1.exeattrib.exeNET.exeNET.exenet1.exenet1.exenotepad.exenotepad.exeNET.exeNET.exeattrib.exeNET.exeOpaserv.l.exenet1.exeNET.exeNET.exenet1.exeNET.exenotepad.exeattrib.exeattrib.exenotepad.exeKobalc.exeNET.exewinupdate.exenet1.exenotepad.exeattrib.exeNET.exeWINWORD.EXENET.exewinupdate.exewinupdate.exenotepad.exeWINWORD.EXEnet1.exeNET.exenotepad.exeNET.exeNET.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opaserv.l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

9384 PING.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
9384	PING.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies data under HKEY_USERS 58 IoCs

Processes:

netsh.exenetsh.exenetsh.exewmsncs.exenetsh.exenetsh.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spool Driver Service = "C:\\Windows\\system32\\spool\\drivers\\wmsncs.exe"	wmsncs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Active Setup\Installed Components\{103L3C30-C3B3-4130-9363-E59E1375PERM}	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidMediaCenter = "C:\\Program Files (x86)\\Common Files\\System\\wmsncs.exe"	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Active Setup\Installed Components	wmsncs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wmsncs Service = "C:\\Windows\\Fonts\\wmsncs.exe"	wmsncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wmsncs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wmsncs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wins Service = "C:\\Windows\\system32\\wins\\wmsncs.exe"	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Active Setup\Installed Components\{103L3C30-C3B3-4130-9363-E59E1375PERM}\StubPath = "C:\\Windows\\Fonts\\wmsncs.exe"	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run	wmsncs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wmsncs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wmsncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer = "65534"	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server = "65534"	wmsncs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wmsncs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Active Setup	wmsncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wmsncs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Active Setup\Installed Components\{103L3C30-C3B3-4130-9363-E59E1375PERM}	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wmsncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings firefox.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

9224 reg.exe
8364 reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	firefox.exe

pid	process
9224	reg.exe
8364	reg.exe

NTFS ADS 13 IoCs

Processes:

wmsncs.exefirefox.exeKobalc.exe

description	ioc	process
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\wmsncs.exe\:Zone.Identifier:$DATA	wmsncs.exe
File created	C:\Users\Admin\Downloads\Rahack.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CodeRed.a.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\EternalRocks.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Opaserv.l.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\metrofax.doc:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Blaster.E.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Kobalc.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Sasser.A.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Adwind.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Blackkomet.exe:Zone.Identifier	firefox.exe
File created	C:\Windows\Fonts\wmsncs.exe\:Zone.Identifier:$DATA	Kobalc.exe
File created	C:\Program Files (x86)\Common Files\System\wmsncs.exe\:Zone.Identifier:$DATA	wmsncs.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

9384 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

8424 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

3980 WINWORD.EXE

pid	process
9384	PING.EXE

pid	process
8424	schtasks.exe

pid	process
3980	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Opaserv.l.exe

pid	process
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe
4028	Opaserv.l.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exeKobalc.exewmsncs.exeOpaserv.l.exemsload.exe8tr.exeBlackkomet.exewinupdate.exe

description	pid	process
Token: SeDebugPrivilege	2056	firefox.exe
Token: SeDebugPrivilege	2056	firefox.exe
Token: 33	1780	Kobalc.exe
Token: SeIncBasePriorityPrivilege	1780	Kobalc.exe
Token: 33	2284	wmsncs.exe
Token: SeIncBasePriorityPrivilege	2284	wmsncs.exe
Token: SeDebugPrivilege	4028	Opaserv.l.exe
Token: SeDebugPrivilege	3244	msload.exe
Token: SeShutdownPrivilege	3244	msload.exe
Token: SeDebugPrivilege	2056	firefox.exe
Token: SeImpersonatePrivilege	3888	8tr.exe
Token: SeTcbPrivilege	3888	8tr.exe
Token: SeChangeNotifyPrivilege	3888	8tr.exe
Token: SeCreateTokenPrivilege	3888	8tr.exe
Token: SeBackupPrivilege	3888	8tr.exe
Token: SeRestorePrivilege	3888	8tr.exe
Token: SeIncreaseQuotaPrivilege	3888	8tr.exe
Token: SeAssignPrimaryTokenPrivilege	3888	8tr.exe
Token: SeIncreaseQuotaPrivilege	1560	Blackkomet.exe
Token: SeSecurityPrivilege	1560	Blackkomet.exe
Token: SeTakeOwnershipPrivilege	1560	Blackkomet.exe
Token: SeLoadDriverPrivilege	1560	Blackkomet.exe
Token: SeSystemProfilePrivilege	1560	Blackkomet.exe
Token: SeSystemtimePrivilege	1560	Blackkomet.exe
Token: SeProfSingleProcessPrivilege	1560	Blackkomet.exe
Token: SeIncBasePriorityPrivilege	1560	Blackkomet.exe
Token: SeCreatePagefilePrivilege	1560	Blackkomet.exe
Token: SeBackupPrivilege	1560	Blackkomet.exe
Token: SeRestorePrivilege	1560	Blackkomet.exe
Token: SeShutdownPrivilege	1560	Blackkomet.exe
Token: SeDebugPrivilege	1560	Blackkomet.exe
Token: SeSystemEnvironmentPrivilege	1560	Blackkomet.exe
Token: SeChangeNotifyPrivilege	1560	Blackkomet.exe
Token: SeRemoteShutdownPrivilege	1560	Blackkomet.exe
Token: SeUndockPrivilege	1560	Blackkomet.exe
Token: SeManageVolumePrivilege	1560	Blackkomet.exe
Token: SeImpersonatePrivilege	1560	Blackkomet.exe
Token: SeCreateGlobalPrivilege	1560	Blackkomet.exe
Token: 33	1560	Blackkomet.exe
Token: 34	1560	Blackkomet.exe
Token: 35	1560	Blackkomet.exe
Token: SeIncreaseQuotaPrivilege	2024	winupdate.exe
Token: SeSecurityPrivilege	2024	winupdate.exe
Token: SeTakeOwnershipPrivilege	2024	winupdate.exe
Token: SeLoadDriverPrivilege	2024	winupdate.exe
Token: SeSystemProfilePrivilege	2024	winupdate.exe
Token: SeSystemtimePrivilege	2024	winupdate.exe
Token: SeProfSingleProcessPrivilege	2024	winupdate.exe
Token: SeIncBasePriorityPrivilege	2024	winupdate.exe
Token: SeCreatePagefilePrivilege	2024	winupdate.exe
Token: SeBackupPrivilege	2024	winupdate.exe
Token: SeRestorePrivilege	2024	winupdate.exe
Token: SeShutdownPrivilege	2024	winupdate.exe
Token: SeDebugPrivilege	2024	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2024	winupdate.exe
Token: SeChangeNotifyPrivilege	2024	winupdate.exe
Token: SeRemoteShutdownPrivilege	2024	winupdate.exe
Token: SeUndockPrivilege	2024	winupdate.exe
Token: SeManageVolumePrivilege	2024	winupdate.exe
Token: SeImpersonatePrivilege	2024	winupdate.exe
Token: SeCreateGlobalPrivilege	2024	winupdate.exe
Token: 33	2024	winupdate.exe
Token: 34	2024	winupdate.exe
Token: 35	2024	winupdate.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

firefox.exe

pid process

2056 firefox.exe
2056 firefox.exe
2056 firefox.exe
2056 firefox.exe
2056 firefox.exe
2056 firefox.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

firefox.exe

pid process

2056 firefox.exe
2056 firefox.exe
2056 firefox.exe
2056 firefox.exe
2056 firefox.exe

Suspicious use of SetWindowsHookEx 40 IoCs

Processes:

firefox.exeWINWORD.EXEWINWORD.EXE

pid	process
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
3980	WINWORD.EXE
3980	WINWORD.EXE
2436	WINWORD.EXE
2436	WINWORD.EXE
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe
2056	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2808 wrote to memory of 2056	2808	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2772	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2772	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2772	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 2752	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 3028	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 3028	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 3028	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 3028	2056	firefox.exe	firefox.exe
PID 2056 wrote to memory of 3028	2056	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

pid	process
8256	attrib.exe
8652	attrib.exe
9904	attrib.exe
8512	attrib.exe
8136	attrib.exe
4604	attrib.exe
7204	attrib.exe
9268	attrib.exe
6280	attrib.exe
8416	attrib.exe
4428	attrib.exe
5856	attrib.exe
1752	attrib.exe
4752	attrib.exe
4768	attrib.exe
5716	attrib.exe
10724	attrib.exe
6436	attrib.exe
10412	attrib.exe
8268	attrib.exe
3544	attrib.exe
4596	attrib.exe
5112	attrib.exe
3576	attrib.exe
3144	attrib.exe
3492	attrib.exe
6312	attrib.exe
7920	attrib.exe
7800	attrib.exe
3932	attrib.exe
5224	attrib.exe
4912	attrib.exe
4100	attrib.exe
8504	attrib.exe
4596	attrib.exe
4056	attrib.exe
6116	attrib.exe
6488	attrib.exe
4504	attrib.exe
6356	attrib.exe
7068	attrib.exe
4472	attrib.exe
4212	attrib.exe
3564	attrib.exe
6084	attrib.exe
3460	attrib.exe
5212	attrib.exe
9672	attrib.exe
3356	attrib.exe
3432	attrib.exe
4560	attrib.exe
5264	attrib.exe
4984	attrib.exe
976	attrib.exe
10796	attrib.exe
5084	attrib.exe
5584	attrib.exe
9804	attrib.exe
3808	attrib.exe
7860	attrib.exe
7100	attrib.exe
6352	attrib.exe
7488	attrib.exe
9748	attrib.exe

outlook_office_path 1 IoCs

Processes:

8tr.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	8tr.exe

outlook_win_path 1 IoCs

Processes:

8tr.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	8tr.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Da2dalus/The-MALWARE-Repo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Da2dalus/The-MALWARE-Repo
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2056.0.1059659910\137997808" -parentBuildID 20221007134813 -prefsHandle 1240 -prefMapHandle 1232 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {806675d0-dbf7-48e5-a990-04c61b6741ba} 2056 "\\.\pipe\gecko-crash-server-pipe.2056" 1304 42f5e58 gpu
    3⤵
    PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2056.1.1103170768\988636393" -parentBuildID 20221007134813 -prefsHandle 1508 -prefMapHandle 1504 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b79d684-82bc-4eb7-a0f2-62fed0ba0ca4} 2056 "\\.\pipe\gecko-crash-server-pipe.2056" 1520 e71958 socket
    3⤵
    PID:2752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2056.2.1728484584\467090984" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {384a049d-b202-4eb9-a56d-88ceffaa83ac} 2056 "\\.\pipe\gecko-crash-server-pipe.2056" 2108 1ab9cb58 tab
    3⤵
    PID:3028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2056.3.1912705915\1389304101" -childID 2 -isForBrowser -prefsHandle 800 -prefMapHandle 796 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06b7413b-0d2a-47ab-8d64-48cf72b597e2} 2056 "\\.\pipe\gecko-crash-server-pipe.2056" 2668 e67858 tab
    3⤵
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2056.4.405912710\909216579" -childID 3 -isForBrowser -prefsHandle 2856 -prefMapHandle 3964 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38d64493-ad3b-4fcb-9d78-bcc438ad101c} 2056 "\\.\pipe\gecko-crash-server-pipe.2056" 3932 22853858 tab
    3⤵
    PID:2496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2056.5.774757181\951303195" -childID 4 -isForBrowser -prefsHandle 3928 -prefMapHandle 3760 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b94e22ed-8082-4765-9298-5e7b9be48570} 2056 "\\.\pipe\gecko-crash-server-pipe.2056" 3752 22853e58 tab
    3⤵
    PID:1868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2056.6.1286117132\757877623" -childID 5 -isForBrowser -prefsHandle 3932 -prefMapHandle 3752 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c98133c-5085-49b6-a27a-157c5a6dd291} 2056 "\\.\pipe\gecko-crash-server-pipe.2056" 4112 22855c58 tab
    3⤵
    PID:828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2056.7.1832316579\2022078336" -childID 6 -isForBrowser -prefsHandle 4596 -prefMapHandle 4568 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81c88b29-b316-4991-8ebf-e2324c589dde} 2056 "\\.\pipe\gecko-crash-server-pipe.2056" 4588 22da3f58 tab
    3⤵
    PID:1148
- - C:\Users\Admin\Downloads\Blaster.E.exe
    "C:\Users\Admin\Downloads\Blaster.E.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:472
- - C:\Users\Admin\Downloads\Kobalc.exe
    "C:\Users\Admin\Downloads\Kobalc.exe"
    3⤵
    - Looks for VMWare Tools registry key
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- - C:\Users\Admin\Downloads\Rahack.exe
    "C:\Users\Admin\Downloads\Rahack.exe"
    3⤵
    - Executes dropped EXE
    PID:3412
- - C:\Users\Admin\Downloads\Sasser.A.exe
    "C:\Users\Admin\Downloads\Sasser.A.exe"
    3⤵
    - Executes dropped EXE
    PID:3716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 52
      4⤵
      Loads dropped DLL
      Program crash
      PID:3764
- - C:\Users\Admin\Downloads\Rahack.exe
    "C:\Users\Admin\Downloads\Rahack.exe"
    3⤵
    - Executes dropped EXE
    PID:3912
- - C:\Users\Admin\Downloads\EternalRocks.exe
    "C:\Users\Admin\Downloads\EternalRocks.exe"
    3⤵
    - Executes dropped EXE
    PID:3236
- - C:\Users\Admin\Downloads\Opaserv.l.exe
    "C:\Users\Admin\Downloads\Opaserv.l.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP NAVAPSVC
      4⤵
      PID:3132
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        5⤵
        
        PID:1488
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP PERSFW
      4⤵
      System Location Discovery: System Language Discovery
      PID:3120
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP AVPCC
      4⤵
      System Location Discovery: System Language Discovery
      PID:3084
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        5⤵
        
        PID:3192
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:1556
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        5⤵
        
        PID:3096
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP SWEEPSRV.SYS
      4⤵
      PID:2516
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        5⤵
        
        PID:3184
  - - C:\WINDOWS\system\msload.exe
      C:\WINDOWS\system\msload.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:3244
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:3292
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:3472
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:3340
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:3488
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:3348
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:1264
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:3356
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:3480
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:3752
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:3732
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:3764
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:1380
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:3620
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3416
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:3576
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:3356
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:1788
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:3508
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:2956
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:3672
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:3528
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:3704
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:3436
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:3248
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:3176
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:3256
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:3500
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:3508
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:2312
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:3560
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:3756
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:3576
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:3588
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3628
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:1756
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:3716
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:3896
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:3620
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:1560
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3784
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:3108
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:3904
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:3176
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:892
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:3336
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:3984
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:3436
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:3980
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:2220
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:1524
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:3576
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:2012
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:3532
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:3616
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:3896
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:3080
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:3516
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:3232
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:1992
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:892
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:2448
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:3840
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:3144
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:3980
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:4104
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:3576
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:3460
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:3400
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:3248
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:3864
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:3900
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:10912
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:11084
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:10920
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:11056
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:10928
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:11020
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:10936
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:11076
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:10944
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:11068
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:5964
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:6572
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:5972
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:6384
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:5980
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:6396
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:5992
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:6084
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:6008
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:6060
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:10080
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:10200
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:10096
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:10668
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:10128
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:10620
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:10468
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:10684
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:10456
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:10676
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:5456
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:5540
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:5880
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:6824
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:5668
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:6840
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:5676
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:6836
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:5688
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:5920
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:9612
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:9964
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:9604
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:9860
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:9632
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:10024
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:9644
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:9976
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:9732
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:10012
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:10516
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:10596
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:10620
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:10788
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:10568
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:10920
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:10132
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:11140
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:10608
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:10808
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:4284
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:4320
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:3780
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:4460
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:3436
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:4976
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:4464
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:10412
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:11168
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:10876
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:5468
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:6716
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:5588
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:4784
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:5632
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:6352
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:4632
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:3928
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:4324
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:4380
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:10968
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:4108
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:3176
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:9816
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:8476
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:4240
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:10536
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:1600
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:8976
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:5016
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:10268
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:5368
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:2304
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:6644
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:9544
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:7144
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:9704
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:5032
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:9864
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:6300
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:5768
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:8972
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:5800
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:6312
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:6048
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:5972
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:6344
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:6544
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:5924
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:9348
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:7460
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:7784
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:7388
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:7448
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:6968
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:7468
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:7516
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:7484
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:7348
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:7904
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:5108
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:8148
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:9108
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:8732
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:9400
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:7920
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:11244
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:8564
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:9124
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:7652
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:9448
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:10264
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:976
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:9928
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:9608
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:10292
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:3308
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:10012
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:9580
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:9980
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:5156
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:7568
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:5280
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:6480
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:5420
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:8812
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:5432
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:9156
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:6064
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:7324
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:10668
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:8840
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:8180
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:9920
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:8732
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:8912
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:8148
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:9120
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:9104
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:10632
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:10132
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:9360
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:11072
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:11132
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:10680
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:9868
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:10488
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:10788
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:10532
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:4248
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:6180
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP NAVAPSVC
        6⤵
        
        PID:2220
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:10576
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP PERSFW
        6⤵
        
        PID:4672
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:4492
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP AVPCC
        6⤵
        
        PID:4480
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:8336
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP MCSHIELD
        6⤵
        
        PID:10904
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:9376
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SWEEPSRV.SYS
        6⤵
        
        PID:5276
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP NAVAPSVC
        5⤵
        
        PID:9728
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP PERSFW
        5⤵
        
        PID:9908
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP AVPCC
        5⤵
        
        PID:9588
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP MCSHIELD
        5⤵
        
        PID:3800
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SWEEPSRV.SYS
        5⤵
        
        PID:9776
- - C:\Users\Admin\Downloads\Blackkomet.exe
    "C:\Users\Admin\Downloads\Blackkomet.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\Downloads\Blackkomet.exe" +s +h
      4⤵
      PID:3176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\Downloads" +s +h
      4⤵
      PID:3112
  - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
      "C:\Windows\system32\Windupdt\winupdate.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      PID:2024
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4040
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        5⤵
        Views/modifies file attributes
        
        PID:3932
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3788
    - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2480
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1400
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3356
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1752
      - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3984
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        7⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3564
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        7⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3760
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        8⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3160
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        8⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3144
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3532
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        8⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3644
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        9⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        9⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1524
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        Drops file in System32 directory
        
        PID:3572
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        9⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        10⤵
        Adds Run key to start application
        
        PID:3716
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        10⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3084
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        11⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        11⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        Sets file to hidden
        
        PID:1132
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        11⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3400
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        12⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        12⤵
        Drops file in System32 directory
        
        PID:4012
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        12⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        12⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        13⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3788
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        13⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        13⤵
        Sets file to hidden
        
        PID:3212
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        13⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3544
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        14⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3480
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        14⤵
        Drops file in System32 directory
        
        PID:3520
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        14⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:656
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        14⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        15⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3332
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        15⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:3568
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        15⤵
        Drops file in System32 directory
        
        PID:3580
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        15⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        16⤵
        Sets file to hidden
        
        PID:3568
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        16⤵
        Sets file to hidden
        
        PID:2480
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        16⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        17⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        17⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        17⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:976
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        17⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        18⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        18⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3808
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        18⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        18⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        19⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        19⤵
        Views/modifies file attributes
        
        PID:3432
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        19⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        19⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        20⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        20⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        20⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        20⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        21⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        21⤵
        Views/modifies file attributes
        
        PID:3544
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        21⤵
        Views/modifies file attributes
        
        PID:3460
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        21⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        22⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3576
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        22⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        22⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        23⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        23⤵
        Sets file to hidden
        
        PID:3568
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        23⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        23⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        24⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        24⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        24⤵
        Views/modifies file attributes
        
        PID:4472
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        24⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        25⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        25⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        25⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        25⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        26⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        26⤵
        Views/modifies file attributes
        
        PID:4100
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3492
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        26⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        27⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        27⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4504
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        27⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        27⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        28⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        28⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        28⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        28⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        29⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        29⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        29⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        29⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        30⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        30⤵
        Views/modifies file attributes
        
        PID:4596
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        30⤵
        Views/modifies file attributes
        
        PID:4604
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        30⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        31⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        31⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        31⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        31⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        32⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        32⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        32⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4428
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        32⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        33⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        33⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        33⤵
        Sets file to hidden
        
        PID:4540
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        33⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        34⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        34⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        34⤵
        Views/modifies file attributes
        
        PID:4212
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        34⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        35⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        35⤵
        Sets file to hidden
        
        PID:4840
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        35⤵
        Views/modifies file attributes
        
        PID:4768
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        35⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        36⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        36⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        36⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        36⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        37⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        37⤵
        Views/modifies file attributes
        
        PID:4560
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        37⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        37⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        38⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        38⤵
        Sets file to hidden
        
        PID:3492
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        38⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        38⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        39⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        39⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        39⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        39⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        40⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        40⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        40⤵
        Views/modifies file attributes
        
        PID:4752
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        40⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        41⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        41⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        41⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        41⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        42⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        42⤵
        Views/modifies file attributes
        
        PID:4912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        42⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        42⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        43⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        43⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        43⤵
        Sets file to hidden
        
        PID:3980
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        43⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        44⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        44⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        44⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        44⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        45⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        45⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        45⤵
        Views/modifies file attributes
        
        PID:5856
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        45⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        46⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        46⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        46⤵
        Views/modifies file attributes
        
        PID:6312
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        46⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        47⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        47⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        47⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        47⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        48⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        48⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:7204
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        48⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        48⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        49⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        49⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        49⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        49⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        50⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        50⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        50⤵
        Sets file to hidden
        
        PID:8060
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        50⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        51⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        51⤵
        Views/modifies file attributes
        
        PID:8504
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        51⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        51⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        52⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        52⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        52⤵
        Sets file to hidden
        
        PID:9000
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        52⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        53⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        53⤵
        Sets file to hidden
        
        PID:9440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        53⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        53⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        54⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        54⤵
        Views/modifies file attributes
        
        PID:9904
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        54⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        54⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        55⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        55⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        55⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        55⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        56⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        56⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        56⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        56⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        57⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        57⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        57⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        57⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        58⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        58⤵
        Views/modifies file attributes
        
        PID:6116
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        58⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        58⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        59⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        59⤵
        Sets file to hidden
        
        PID:8876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        59⤵
        Sets file to hidden
        
        PID:9164
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        59⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        60⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        60⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        60⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5224
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        60⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        61⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        61⤵
        Sets file to hidden
        
        PID:5704
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        61⤵
        Views/modifies file attributes
        
        PID:5716
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        61⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        62⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        62⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        62⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        62⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        63⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        63⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        63⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        63⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        64⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        64⤵
        Sets file to hidden
        
        PID:7324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        64⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        64⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        65⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        65⤵
        Views/modifies file attributes
        
        PID:7860
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        65⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        65⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        66⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        66⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        66⤵
        Sets file to hidden
        
        PID:8268
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        66⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        67⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        67⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        67⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        67⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        68⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        68⤵
        Views/modifies file attributes
        
        PID:9268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        68⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        68⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        69⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        69⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        69⤵
        Views/modifies file attributes
        
        PID:9804
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        69⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        70⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        70⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        70⤵
        Sets file to hidden
        
        PID:10268
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        70⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        71⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        71⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        71⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:10724
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        71⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        72⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        72⤵
        Sets file to hidden
        
        PID:11200
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        72⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        72⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        73⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        73⤵
        Views/modifies file attributes
        
        PID:6356
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        73⤵
        Sets file to hidden
        
        PID:4380
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        73⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        74⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        74⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        74⤵
        Views/modifies file attributes
        
        PID:5112
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        74⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        75⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        75⤵
        Sets file to hidden
        
        PID:5492
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        75⤵
        Views/modifies file attributes
        
        PID:5264
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        75⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        76⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        76⤵
        Sets file to hidden
        
        PID:5816
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        76⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        76⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        77⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        77⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:6084
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        77⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        77⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        78⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        78⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:6436
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        78⤵
        Sets file to hidden
        
        PID:6596
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        78⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        79⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        79⤵
        Sets file to hidden
        
        PID:7392
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        79⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        79⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        80⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        80⤵
        Views/modifies file attributes
        
        PID:7920
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        80⤵
        Sets file to hidden
        
        PID:7876
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        80⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        81⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        81⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        81⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        81⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        82⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        82⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:8512
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        82⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        82⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        83⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        83⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        83⤵
        Sets file to hidden
        
        PID:9624
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        83⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        84⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        84⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        84⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        84⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        85⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        85⤵
        Views/modifies file attributes
        
        PID:10796
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        85⤵
        Sets file to hidden
        
        PID:10596
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        85⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        86⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        86⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        86⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        86⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        87⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        87⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        87⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        87⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        88⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        88⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4984
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        88⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        88⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        89⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        89⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        89⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        89⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        90⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        90⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        90⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        90⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        91⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        91⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        91⤵
        Views/modifies file attributes
        
        PID:6488
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        91⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        92⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        92⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        92⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        92⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        93⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        93⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        93⤵
        Views/modifies file attributes
        
        PID:7100
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        93⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        94⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        94⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:8136
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        94⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        94⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        95⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        95⤵
        Views/modifies file attributes
        
        PID:8652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        95⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        95⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        96⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        96⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        96⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        96⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        97⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        97⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        97⤵
        Views/modifies file attributes
        
        PID:9672
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        97⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        98⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        98⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        98⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        98⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        99⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        99⤵
        Sets file to hidden
        
        PID:10744
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        99⤵
        Views/modifies file attributes
        
        PID:10412
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        99⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        100⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        100⤵
        Views/modifies file attributes
        
        PID:5084
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        100⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        100⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        101⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        101⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        101⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        101⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        102⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        102⤵
        Sets file to hidden
        
        PID:4864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        102⤵
        Sets file to hidden
        
        PID:3432
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        102⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        103⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        103⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        103⤵
        Views/modifies file attributes
        
        PID:5584
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        103⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        104⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        104⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        104⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        104⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        105⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        105⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        105⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        105⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        106⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        106⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        106⤵
        Views/modifies file attributes
        
        PID:7800
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        106⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        107⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        107⤵
        Views/modifies file attributes
        
        PID:8256
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        107⤵
        Views/modifies file attributes
        
        PID:8268
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        107⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        108⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        108⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        108⤵
        Sets file to hidden
        
        PID:8640
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        108⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        109⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        109⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        109⤵
        Sets file to hidden
        
        PID:9316
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        109⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        110⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        110⤵
        Sets file to hidden
        
        PID:10288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        110⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        110⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        111⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        111⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        111⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        111⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        112⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        112⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        112⤵
        Views/modifies file attributes
        
        PID:4596
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        112⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        113⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        113⤵
        Views/modifies file attributes
        
        PID:6352
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        113⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        113⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        114⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        114⤵
        Sets file to hidden
        
        PID:2220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        114⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        114⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        115⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        115⤵
        Sets file to hidden
        
        PID:5544
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        115⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        115⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        116⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        116⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        116⤵
        Views/modifies file attributes
        
        PID:6280
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        116⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        117⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        117⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        117⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        117⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        118⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        118⤵
        Sets file to hidden
        
        PID:7500
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        118⤵
        Views/modifies file attributes
        
        PID:7488
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        118⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        119⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        119⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        119⤵
        Sets file to hidden
        
        PID:8012
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        119⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        120⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        120⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        120⤵
        Sets file to hidden
        
        PID:8592
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        120⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        121⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        121⤵
        Sets file to hidden
        
        PID:9268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        121⤵
        Sets file to hidden
        
        PID:9320
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        121⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        122⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        122⤵
        Sets file to hidden
        
        PID:9380
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        122⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:9748
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        122⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        123⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        123⤵
        Sets file to hidden
        
        PID:7252
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        123⤵
        Sets file to hidden
        
        PID:7380
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        123⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        124⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        124⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        124⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        124⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        125⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        125⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        125⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        125⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        126⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        126⤵
        Sets file to hidden
        
        PID:7676
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        126⤵
        Views/modifies file attributes
        
        PID:7068
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        126⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        127⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        127⤵
        Views/modifies file attributes
        
        PID:8416
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        127⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        127⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        126⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        125⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        124⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        123⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        122⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        121⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        120⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        119⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        118⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        117⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        116⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        115⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        114⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        113⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        112⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        111⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        110⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        109⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        108⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        107⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        106⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        105⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        104⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        103⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        102⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        101⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        100⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        99⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        98⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        97⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        96⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        95⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        94⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        93⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        92⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        91⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        90⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        89⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        88⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        87⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        86⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        85⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        84⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        83⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        82⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        81⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        80⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        79⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        78⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        77⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        76⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        75⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        74⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        73⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        72⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        71⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        70⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        69⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        68⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        67⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        66⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        65⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        64⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        63⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        62⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        61⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        60⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        59⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        58⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        57⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        56⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        55⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        54⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        53⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        52⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        51⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        50⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        49⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        48⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        47⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        46⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        45⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        44⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        43⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        42⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        41⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        40⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        39⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        38⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        37⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        36⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        35⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        34⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        33⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        32⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        31⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        30⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        29⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        28⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        27⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        26⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        25⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        24⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        23⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        22⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        21⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        20⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        19⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        18⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        17⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        16⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        13⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        12⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        11⤵
        
        PID:932
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        9⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        8⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        6⤵
        
        PID:3904
    - - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        5⤵
        
        PID:3188
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\SysWOW64\notepad.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2316
- - C:\Users\Admin\Downloads\CrimsonRAT.exe
    "C:\Users\Admin\Downloads\CrimsonRAT.exe"
    3⤵
    PID:9104
  - - C:\ProgramData\Hdlharas\dlrarhsiva.exe
      "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
      4⤵
      PID:8968
- - C:\Users\Admin\Downloads\NJRat.exe
    "C:\Users\Admin\Downloads\NJRat.exe"
    3⤵
    PID:8108
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\Downloads\NJRat.exe" "NJRat.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:10916
- - C:\Users\Admin\Downloads\NetWire.exe
    "C:\Users\Admin\Downloads\NetWire.exe"
    3⤵
    PID:9856
  - - C:\Users\Admin\Downloads\NetWire.exe
      "C:\Users\Admin\Downloads\NetWire.exe"
      4⤵
      PID:8604
- - C:\Users\Admin\Downloads\Remcos.exe
    "C:\Users\Admin\Downloads\Remcos.exe"
    3⤵
    PID:6572
  - - C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      PID:5756
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        Modifies registry key
        
        PID:8364
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
      4⤵
      PID:6328
    - - C:\Windows\SysWOW64\PING.EXE
        
        PING 127.0.0.1 -n 2
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9384
    - - C:\Windows\SysWOW64\Userdata\Userdata.exe
        
        "C:\Windows\SysWOW64\Userdata\Userdata.exe"
        5⤵
        
        PID:6860
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:9224
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:5680
- - C:\Users\Admin\Downloads\RevengeRAT.exe
    "C:\Users\Admin\Downloads\RevengeRAT.exe"
    3⤵
    PID:6392
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6496
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:6888
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pumom2ia.cmdline"
        5⤵
        
        PID:4100
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rhkh0lqm.cmdline"
        5⤵
        
        PID:5196
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\crjqj84n.cmdline"
        5⤵
        
        PID:6128
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\equxk1sd.cmdline"
        5⤵
        
        PID:5608
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o3criova.cmdline"
        5⤵
        
        PID:8224
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k1aiqbxp.cmdline"
        5⤵
        
        PID:7620
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nk-1gn_v.cmdline"
        5⤵
        
        PID:10536
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mbifpnnw.cmdline"
        5⤵
        
        PID:10508
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dv7gcpos.cmdline"
        5⤵
        
        PID:5284
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mfy3k05l.cmdline"
        5⤵
        
        PID:2448
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\srq4kk7r.cmdline"
        5⤵
        
        PID:5628
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yrw6w1ap.cmdline"
        5⤵
        
        PID:6720
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yvwtyedf.cmdline"
        5⤵
        
        PID:8164
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9wengony.cmdline"
        5⤵
        
        PID:9300
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cy5iwxxw.cmdline"
        5⤵
        
        PID:10864
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wfspek88.cmdline"
        5⤵
        
        PID:5572
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hp7lqgum.cmdline"
        5⤵
        
        PID:8096
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wgswgoid.cmdline"
        5⤵
        
        PID:9988
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n3crifqq.cmdline"
        5⤵
        
        PID:7212
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u0k3rzzk.cmdline"
        5⤵
        
        PID:10200
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3zgqbp73.cmdline"
        5⤵
        
        PID:7936
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ltme4ycp.cmdline"
        5⤵
        
        PID:9688
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7DE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7DD.tmp"
        6⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
        5⤵
        
        PID:9476
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        6⤵
        
        PID:9936
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        7⤵
        
        PID:10068
- - C:\Users\Admin\Downloads\WarzoneRAT.exe
    "C:\Users\Admin\Downloads\WarzoneRAT.exe"
    3⤵
    PID:7784
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1120.tmp"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8424
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:8060
- - C:\Users\Admin\Downloads\GoldenEye.exe
    "C:\Users\Admin\Downloads\GoldenEye.exe"
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Roaming\{6dba107b-96b7-408d-b345-7bd67218dcbd}\shutdown.exe
      "C:\Users\Admin\AppData\Roaming\{6dba107b-96b7-408d-b345-7bd67218dcbd}\shutdown.exe"
      4⤵
      PID:5128
- - C:\Users\Admin\Downloads\$uckyLocker.exe
    "C:\Users\Admin\Downloads\$uckyLocker.exe"
    3⤵
    PID:6580

C:\Windows\Fonts\wmsncs.exe
"C:\Windows\Fonts\wmsncs.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2284
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set portopening TCP 1013 BS
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:892
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set portopening TCP 8080 PORT1
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:2448
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set portopening TCP 8081 PORT2
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1044
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Windows\Fonts\wmsncs.exe" workstation ENABLE ALL
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:1860
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set allowedprogram "C:\Windows\Fonts\wmsncs.exe" workstation ENABLE ALL
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:656

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Downloads\metrofax.doc"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3980
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\8tr.exe
  C:\Users\Admin\AppData\Local\Temp\8tr.exe
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /K
    3⤵
    PID:3964

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2436

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3942648692145765148-1738481908-1856833060162738244927545539615103262-22632746"
1⤵
PID:3564

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "855341652570836711-346066338-2138440429-430820013-1922909747-1029187638495833128"
1⤵
PID:1524

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-716856473538881519-10279414291987642491-1860182091-18344809835462864711981964592"
1⤵
PID:656

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19611234401286810640730499731-1106808556225811040-1817383017682443972-1992692916"
1⤵
PID:3760

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Downloads\CobaltStrike.doc"
1⤵
PID:4420
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\\SysWOW64\\rundll32.exe
  2⤵
  - Process spawned unexpected child process
  PID:4920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-134942181954060031-12604750631860438993-2062920998-2136618950-15931777841144866018"
1⤵
PID:2516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1166071208-339361784193042981-15509790221223090332-2036041636-457632406-446918876"
1⤵
PID:3544

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Downloads\NetWire.doc"
1⤵
PID:10168
- C:\Windows\SysWOW64\runonce.exe
  "C:\Windows\system32\runonce.exe"
  2⤵
  - Process spawned unexpected child process
  PID:10056

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\VanToM-Rat.bat
1⤵
PID:9144

C:\Users\Admin\Downloads\VanToM-Rat.bat
"C:\Users\Admin\Downloads\VanToM-Rat.bat"
1⤵
PID:10360
- C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe
  "C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe"
  2⤵
  PID:10184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\svchost\vcredist2012_x86_0_vcRuntimeMinimum_x86.ico

Filesize
4KB

MD5
c398ae0c9782f218c0068cd155cb676c

SHA1
7c5bb00a34d55518a401cd3c60c8821ed58eb433

SHA256
9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3

SHA512
85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\70C92A92.emf

Filesize
5KB

MD5
0ed5bc16545d23c325d756013579a697

SHA1
dcdde3196414a743177131d7d906cb67315d88e7

SHA256
3e430584cd9774ea3b21d8e19b485b48212fe356776158dd5f3c5f63a5bde7d3

SHA512
c93072d11058fa50e3b09ff4da9f3dbe2637c2b5df05e616bd8ddd04557ea1e8b0db106b1545fad334619118c467776f81cf97ca52d3f2fcbbe007f30032b8af

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp

Filesize
34KB

MD5
8bfcd1fbef15c5808da01c3f013c6426

SHA1
4714cb4ce5968c9cc39d44bbc7c8fcd035e2eef9

SHA256
63446957a2ffa4a6466b5945b04f596a8d1c27254fcc00337bae82566109529b

SHA512
14fcf7a57227c1fdb9af3511a6570da3b2d5793dddc905943a3c4392da3d249705fb9dbebf166c9f5ada635bf33c4dc002c90ff4afa10328281ed6d001c68873

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\cache2\entries\1EF783CDE28375239B0BB63F8A2764B42BFE5B36

Filesize
48KB

MD5
0ee2650272e3b8825fb2a21784d083f0

SHA1
e957306fbf6af612e8ea004383bd23be6d867eb8

SHA256
73eb35152fa32fe8b212a978350efe0c9d1094294ce7c233b00002916c43c9c0

SHA512
ce9923fdc3cfee8dbd078c14811301bc4a87d7ea9ce9969aa1bd8c80f5feb38fe3eae8e60197e9809d30248d25c7d6cd88c114a0093a894b833e08708449a0ca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\cache2\entries\79679B23E6BBEB689E1C79E27C32C20C5EC9DF47

Filesize
22KB

MD5
efb6a08d2e746d1d5254fb143f3d74d0

SHA1
7ee35de3368dba667df12125e5bda15f95f39667

SHA256
13cff39f9be5caa26e181b0d549639bdc27f4ef198022f89e28f6d6985828c79

SHA512
50c9c1371ded72042e8bc195f6e6c4865cd9c5ef037fa09ae2a60b08977cf207eeae76deaa1270e2bd5cb8696b4f375e395cd4e4f6ba0f8fcd2ac7eb3e75f782

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\jumpListCache\skq_om+1nfIG3fM7KKapRw==.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Temp\-17034841.dat

Filesize
474B

MD5
108a846fce8e14bec7a3a8c2850d8ed1

SHA1
44075cdd5403feadd753986ce39fbc672ca9c69a

SHA256
300c5bfa2b54a6c48fb592ba9f2a164dc92d796688f3e43112e696e68a09ed88

SHA512
c2f03dad5d470b779de7e2fe36e26c3b112b4f82db76cd5ebd30da71649f1f26326db0632b1dc2bcbe7b80804d4dc8d878b058ce9798bd5d35b722212f6c78da

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
135B

MD5
90022f82afe48963cc42547209f18f96

SHA1
e60698c77e7df4cccc493f2cfa6d76f7553d71e2

SHA256
046509f2b672f0f5da1b5441649873c736d81853701b67094bb319b025afb2cc

SHA512
6743f17da515c61ba1ab3df53077929d6f480f84978bcf8ae61880015221f245fde6e3a2ffe3dc937f80b37e8774dcc61838ee4ed461658b3a44f02cc0469208

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbhja.rtf

Filesize
802KB

MD5
62072820905122f16ee2a7eb25c65843

SHA1
e119abf19254d1976f6ffcfce1677c0a3e06342d

SHA256
4f9edab882825c56da97e8785692a713aded0af9f3d310ee39938a541563f667

SHA512
57c6ae361d8ef816e1f58eaf53dd965467602fd434cd4ae4005ddfe407e59214a07afab2ddf9b3be012c6b91499c54eadc27748dfd552e00a11bd5da2f3b70ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\~WRD0001.tmp

Filesize
802KB

MD5
50af0b313626e202c0de3b2ec8de0b39

SHA1
8a2cc7fb66ab7603147530a96a25aa76425d5a6f

SHA256
044159011f58794456027140461dcfe154a80ae5d07ea74d944e1837c7e3fb33

SHA512
c1a2e2f75a6d81e98eb459efa2569e4f20195622577999b3cdde999dfc944a104befdf104cf47adbeaff258dec52fd550f2b29ad7e7e885a48a7eda91629abc9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
457B

MD5
2387b7c107d52e697e01eaed1859ec8d

SHA1
00e48adb9b5e15ccbc0223433dd766982217d326

SHA256
a99ce68c03314bcd1873ae05f74ad087f73e267ecbc85584e9ad024c7445395c

SHA512
5c21e0bde1e25e442c5a436047e02f15480b35a09513fb95497fd83cc0c7376bff8e9b8a64c9bd3aef07ca02eb40bd47998f063e2de3aef1fa3190f64a4e8966

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
9d964c1c87991efaf3dd551891873398

SHA1
f3e87e3956ed0ba774955ad222c8b82adcee460a

SHA256
4c13d90685d4532484ed7411a0b7f4eca9f2d2c72674779fc35636f6851efc9f

SHA512
4ab9f567aae1860b3dc880921ec245e74ae8ba7c0221d7ecf08e487383d203f6cb3d5baab07ba1528a8eb2e52dd87984a1cef1fdee60c387ecc9fe8d799b85d7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
1ddf0d489da0725da40f3a2aecbb5c8e

SHA1
8372d1e50cc996d9a9258e4f503aabd39b7b9cca

SHA256
c33f23d00d64cfb9f93969a75b838cf375938e7208c1350b4a55638d4e3775bb

SHA512
df6040806572ac5f240362ca69b09f6d86ae417e0ca74870c867e81d5a86de43535513fdb8b59cbd1715e973f8a2f9a17fa0dd3a3655f98bac7f7f09292e8e1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe:Zone.Identifier

Filesize
221B

MD5
211ee1f33c61841dc0cb15cff59dbc91

SHA1
cc5d291a3ee0c28297bca6fd754a38221cbccdef

SHA256
f715c4cc71a300030e5d1c5e5c4dd95e6b8d56e44d8a53e1b4eedc80bf178669

SHA512
f224c116d34862888e5d530e5f2769debfdd31732af060dcb7c4321dd6abb4e74d8c6e3d3522b7b560cde54abe96168d3e35830fa23cdd5aa212990407eeb793

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
2f3e59ac892a61d56c509d3cdf131daa

SHA1
e4f311f997d607b6ae4f1d72214a334df2b36a84

SHA256
026b47e150c9dee295abe5baae097f43ef671ffca269849c7600d6cfaadb4f28

SHA512
3831797369c5446353ae91df1ae42f9cd585e569123cd4af0ac098ec10a6385bbb251a4f16b818594b760356e65a1bdd2078bd7fa7b363748060e0b6cb6993de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\1eb87535-46fd-4c53-81e9-4b4d2ea45811

Filesize
855B

MD5
294921c19bd8f7859481296ed04b525e

SHA1
b66be157bad6d7eeccc7b187b4b216a7f83fde4b

SHA256
f384de5d153a09d7c0a2e8ab06ded9cb4aa6de0355d606459d52ed639a4aa492

SHA512
6d9cd36267933bcb1251456ebaccae1804562e3841280846b3661fba626b1c8e72d28914a0e4f4255908e7eea4dff66e01f7197305be68c9a45a696885a14bd1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\21b4d0dd-7c49-4edc-82c8-5ad9681c28e4

Filesize
594B

MD5
f7b72fe6a765e1fff4b9d461528b58c8

SHA1
00d4ea3be7f6ad50078083387dd7806f7d035c9d

SHA256
2068faf86268ce768b152efd1785d0f19587e3433f5da37e06249b90615b4cd0

SHA512
faffd546f7c6616b207bd52e12d64c262663aef7ebdc139622c7d8ef759641f70651e2971435ce2a4550fc41e051c3c97b048d7e3dfc083f841801c96cfcb1e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\6342c06a-3b3d-418b-a9e0-c4b94321059f

Filesize
12KB

MD5
07f455a966ce62e3ef5bbe9a17e08251

SHA1
c99cccf720aebec757cab71affe322e2bf65dcde

SHA256
f2916fab96c29751b13aad34b4ffa3fe5a8c22cf242e0e6794477105ac670344

SHA512
6826165fcdeb8a4678ba5f300217d5a7cecf9a98ad3fb78a0c8865096097461788065bf6c0c0d9007e92ca702ca8e687468c713a2b428d29fe7acc7191064a37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\e8ce3724-b14d-4fda-8844-d89f6f16a47e

Filesize
745B

MD5
e1f283e9074310cc7015cd087104a40e

SHA1
5dc9f3221f5e072eba420b15014c868a08da5f93

SHA256
20f61a347f1f9bd62a3278010937b95ad0d6d88627b2523eb83cc4fa0c471f23

SHA512
8e0a4b2bfc68e3e11427ef73fd17c6ca9e57eb3aa303fdc45cb95eccb440d9f3d3984042f06570201e0905591bffae078c35a7211e248db37ef31ea18c466a36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

Filesize
6KB

MD5
d1003fc3582b8927eaec59c5ea1489a2

SHA1
b96c427d8d1c2006a25add82679d9c83d7726ee6

SHA256
0f522da06c95c91a8a57a1f437df4711a3637ea7180710f29731377b60af0042

SHA512
260e1dedc951452ff53feb5bef5e35c04bb33650792fd4a044c62a81e8270d5b46112ee536a970d9694a544f13e82e1b7d9bba9134bbc0336932e2f0db5134e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

Filesize
6KB

MD5
84bf4285accdbd847e8bbed2845b7fe4

SHA1
f084f3edb3c6325b464562fa2ba2cc02901c1830

SHA256
38cb712e18e623e91e038acd3bcd1d124c97fefe5a2cef7927209b6b126658bd

SHA512
0a195e607452418bfcb6add2ae3e0e7170e4d90659618df386d0f9e7f110c88df9c4e254c4a540f4a74adaf75c948539d1b063155921dea34e50b2acb4475ef5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js

Filesize
6KB

MD5
4167908d4a1ffee3dca22a17bddbcf56

SHA1
47793cc23a2bd4114c041b8ecd048f96947864bc

SHA256
0359f2925dc7496514d8812aabe65e81162dff8db668a739e4bc6b95a7817b6b

SHA512
80f0f24a5cb771479ab7a3e394a21d30f0a71e5300adc1557739f87407def9f5cbab020fd437c6c1c568761d69719748f8b974a1da34a540c7cd59b16eaea587

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
f56f60eb7114c9a5a50bd3e0dba0705f

SHA1
bc35165c64831cf066e7516ccf7c1a20c6dd85f9

SHA256
f40e70a46defea5a13361567a198cab1dfd7733f1fe57d85b9c460cdb0ff4278

SHA512
e1ce714ce6ad364205a0606391bc12c894987df0fe93524df722a23b021cb7db611131bf22c95f486198260fe5a0aed19f61ff39a042c556e87e16ee836fb503

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
b66c315ffe4faf7398329935140b3821

SHA1
40682df0f903ed977c75b905d1a1900c5a527fba

SHA256
3ecafcb65fffedfff9a1d01db40d9f522e4d553b7db5275db6b2d14fce2f5b5f

SHA512
5f0a0af3148c315779d1f9ad5fb1ca8dbb98e9441021f55b7c5a81258362b188eeca98b7ae672b7f46e03b1a98c23a9780280a461b7c458a5e96cfaefdf75d54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
09a347224ac54062d030c205188abe5b

SHA1
104809a0c230798b353630229347711cbcd02481

SHA256
b7ec8a87d684939c5e035e17d6cd9460d9ec549ccbe6c9e22d6325b59f6ec87d

SHA512
4f68669e493eedc2f1535cb69ca1d8b9d6cac8b0f3ed00390a847dee0456b593586bea2db894ef932fe2c4dac0a27f75c3515a82617076157f74f8465f7e8e54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
dc8aa2253ca04173a66e153b0ceda3fa

SHA1
26d95ed603ef50a8dc060415019e9c95f3fb41ec

SHA256
4d53ef4a49ab25a973988851244b90f34a01af635939d7c7efe32e53a65eee29

SHA512
9f0ef40082332c1403c511ecaacd66d12d987dd277c62834060af560498ddcba206db2e6a0f89d569e87e8df7ec80f2d0f66eebd569e2f98b58f17f8b17e477d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
61e5d8538c4f27e2ad28dbcd1280cfab

SHA1
7cfc4e4708cfef9e8af2afe00742d76e0dd56fde

SHA256
13dea8520260a09799efff120e5cd1b5e3b76805925894b5601ca81e07340180

SHA512
b340b71e2c5479a727c87230622008fbcb67997e410fa2adc04b80695924dce5ee0eee313dbafb497f2da85c13f621c139931eb013a72a6deb7e91ecf5d9ec2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
f4a294832c6f508159326c7487ec3f06

SHA1
3edd148caa47070462d15aa1b37ca0542f8eef82

SHA256
d77e69d5da17a01fff73a5dbb56c81b0c0aea23be90423005289c272ea02d685

SHA512
67283629c12c0bd7fdf625166d637fbba5c251d63978017092f008afacf3e229b626ca78739c974381060e6843d493c8336b37eb2b4f967a2a707ba073700001

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
7b1c9e82a3c7fa21df10dfed26b85538

SHA1
32960693f221cbef6a03bc5a9709c4c480b5a43f

SHA256
ff613ab1c558c361542eb840e60d3e6b82ffe076822398c863def3451feb1dcd

SHA512
bdc54ad17081272b9633c9ae7f2381f74735324e87ec6b12401af7ea2f160aa8451f0460cbf67ee8e0d6f31c37a5bd108017a427b666c1bb2f7e07013ca97b46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
7cb999007d1a2b7375721aede4944f97

SHA1
cf2ae7e665d17e79a5812968a83a913c6f2f227b

SHA256
751537db495a28510cb8112563c123aa79b6bc09abcb809eddfbf9c234fbe42c

SHA512
d913e2b10aab7b19687023181ac3160a2bba4272411f826872c884e0e7f2ffe7e80357c5a84331f536060dd2c8aba360d129eeb66c91e291833576baf227c395

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
3a28d80ab882e25260553553f132049c

SHA1
5fb1672f338ece5a58a444cc7aebcf62365e04e9

SHA256
c4c3e1a52b6f76517b5edc109dae4199d3dff2ccee23a4b7966bfa8a33722877

SHA512
5f083d38a85822a3dcd39c4f8bd98b11a285a5d4ec996018686ae6b0acd7ec50de06517441b46d03273aac922ffd6f919d4c5e8a3a7f677601aa3744ed345c69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
bbab5ea58a57bdb93bcb761b67278990

SHA1
4a085e9aef087e53621e203fcea509c393f22517

SHA256
2686f6094cb7728bd71ee0de1d457f7467fe657fe336ae208ad978198188155f

SHA512
75abd80ed69893f0d09a6aa26da541c62b3aa83720f493ba83e091eef60a3207b6afca6a45d79a7b249a3c98cdf6d95119ce0cb9267df0245a7482a4bf6d44a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
0f02401d7178900f6e1f0caae9f2fedf

SHA1
3025e5c1dd55e3a8666ddf64cbd70c5478f5db1d

SHA256
a51580e51e4563a81212561a890621c696002a9c1efa29801e8c4bbaec587dd3

SHA512
096fc5fa5011136b634203a14e0d142fe3fcf1e36b000a70e95493e3292019153d80fa70cc67db4302a18584bef6743273193e8bb510c1a7c2dc63c6b0af8b7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
5041625e80308dc7a91f9276643b4700

SHA1
e8d81b96c851606bc04eae3304905d19658d34a9

SHA256
bf044e7d3defd18faa1cacf98d6ca3de1447f574cd1efdbd67a35528cf0ed58d

SHA512
2d3ced88be88f05ec870ff92b119e78a2977b4374eb613a8610c33becea0f74491464907a4c20e16ee892eff66bdfcae167d20bfed64c9f8859624ca19e57538

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
2765db73365ef43535c56ecea1a1f0bf

SHA1
506d965c9147a076014baf1718e54f6c986dc72e

SHA256
32c2567c838d28b54fd1c07c6e7a716f7ed753380a2817f52da3f47ae30235f5

SHA512
147843e64287081568b94d2f0df88b969ac4532a75fb19dc556651630d26400be27ed5ec74b1981ed9a5bdad631421646170a481b3245d21604bfbcccb690e2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
7f47d581357391645c157aa747401f54

SHA1
05ac52ddcbd1beb0fa7bca92211e86306f179852

SHA256
c9af79576fc3565cf655197ffa17f3b005e9d8e7b52b0ecda3a53d861d0054d9

SHA512
646786f39e8f49294b991814b4edfcbdbf0d3b53c8f5fce15ac1382025e91a455c35c401ca950da602b25a92fa87ea1e22524357bf2cdf3738f2b34fda063423

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
b0f56f62fa89706378e6d47d06934500

SHA1
902a0cd40b761bbd2a1f04bcfe0a041819c4fa1d

SHA256
c8ab32bec1ce7eb2bc7be3e0340c661dd9d926a45b92d605f3d318788f92c3ea

SHA512
64f5a3e501e43ab359bf2a018b1a472c0ee58dafef963d73e4a8f3e70e460a371548ec7ee31ca3f59490833ac7ceadb5ba8ebf2c1b59492d4c09c106ba972778

Download Submit
C:\Users\Admin\Downloads\$uckyLocker.xasHALnZ.exe.part

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\Blackkomet.exe

Filesize
756KB

MD5
c7dcd585b7e8b046f209052bcd6dd84b

SHA1
604dcfae9eed4f65c80a4a39454db409291e08fa

SHA256
0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

SHA512
c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

Download Submit
C:\Users\Admin\Downloads\Blaster.E.exe

Filesize
6KB

MD5
8676210e6246948201aa014db471de90

SHA1
86b30d1a8b7515dcab6c8d2781b85c6983709dbf

SHA256
2e481059b9bc9686c676d69a80202eed5022c9a53ecd8cac215e70c601dd7fdc

SHA512
5130e6ea6c5e1924af7d630a7b1c6e614b1482edcad3117a8dc56371269260b97793a7ccdbf3249054815b7c3b9c364b30e73e0f8e4cc230502b01d0d2f70bda

Download Submit
C:\Users\Admin\Downloads\CobaltStrike.oV73fXlR.doc.part

Filesize
15KB

MD5
09ee44b725af5676117b57539f88e374

SHA1
e1778e7d9b00852dcb8ce9ef7a03bcec5f6c6e66

SHA256
58e8aac3fc083b833159b9b5884ae705d13830a4a9032de12e4ee8e8c3a2b58b

SHA512
07e13d6fd50b686b7b9e0120d80f65a09f0ff2ad7ee91ced4aa857ba2073a79293cf844c54aa2fe30ce80007e82e5e537390a2bdd8c8b5d577e34c7a468da9ac

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\EternalRocks.exe

Filesize
5.0MB

MD5
c52f20a854efb013a0a1248fd84aaa95

SHA1
8a2cfe220eebde096c17266f1ba597a1065211ab

SHA256
cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30

SHA512
07b057d4830d3e2d17c7400d56f969c614a8bae4ba1a13603bb53decd1890ddcfbaad452c59cc88e474e2fd3abd62031bf399c2d7cf6dc69405dc8afcea55b9a

Download Submit
C:\Users\Admin\Downloads\GoldenEye.C-vY963B.exe.part

Filesize
254KB

MD5
e3b7d39be5e821b59636d0fe7c2944cc

SHA1
00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

SHA256
389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

SHA512
8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

Download Submit
C:\Users\Admin\Downloads\Kobalc.Q4ry0iBI.exe.part

Filesize
1KB

MD5
c23df82352d2b3d468ca9d4d2670714a

SHA1
70a65ec1382afe57e2e8002a11431014cd1c88e7

SHA256
5e54c1d7d9e6212c830d715de61d6f88e0aae43e1d245e179afcc9f67f3a85ca

SHA512
7605baaa9e1f98d9d073608e73d3e6b2f71242e85ce5ff45959f0607ce9d4ddea9c97b5b20c9877018dd165b50184304fb2bae12b15616182a1f75f134f60af1

Download Submit
C:\Users\Admin\Downloads\Kobalc.exe

Filesize
185KB

MD5
15717cd327a723820d71900611545917

SHA1
99184ec149d329e98cd3e600cfaba22a2f9a0156

SHA256
db6cea7e8d62d3b21efe3b423b48c131e345cb55f168cbe1f142e491bb812747

SHA512
a0de435db809e3e79f89411017e244c76145e010c67f894d41e265804c832f5514ac2f31cc9a0c667afa77aaaf3eccecac148279ca5a0feba492b222d5481a49

Download Submit
C:\Users\Admin\Downloads\NJRat.exe

Filesize
31KB

MD5
29a37b6532a7acefa7580b826f23f6dd

SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f

SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69

SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818

Download Submit
C:\Users\Admin\Downloads\NetWire.cJidlDo2.doc.part

Filesize
7.3MB

MD5
6b23cce75ff84aaa6216e90b6ce6a5f3

SHA1
e6cc0ef23044de9b1f96b67699c55232aea67f7d

SHA256
9105005851fbf7a7d757109cf697237c0766e6948c7d88089ac6cf25fe1e9b15

SHA512
4d0705644ade8e8a215cc3190717850d88f4d532ac875e504cb59b7e5c6dd3ffae69ea946e2208e2286e2f7168709850b7b6e3b6d0572de40cfe442d96bba125

Download Submit
C:\Users\Admin\Downloads\NetWire.gm1piRxC.exe.part

Filesize
1.2MB

MD5
7621f79a7f66c25ad6c636d5248abeb9

SHA1
98304e41f82c3aee82213a286abdee9abf79bcce

SHA256
086d35f26bd2fd886e99744960b394d94e74133c40145a3e2bc6b3877b91ec5d

SHA512
59ffcf6eeac00c089e9c77192663d0dc97b2e62cedb6d64fe7dc2e67499abc34e33977e05113c9d39ca6d3e37e8b5c3e6aa926c8526215808b147c0152f7dbfd

Download Submit
C:\Users\Admin\Downloads\Opaserv.H0aUxsnE.l.exe.part

Filesize
28KB

MD5
71c981d4f5316c3ad1deefe48fddb94a

SHA1
8e59bbdb29c4234bfcd0465bb6526154bd98b8e4

SHA256
de709dacac623c637448dc91f6dfd441a49c89372af2c53e2027e4af5310b95d

SHA512
e6ed88ce880e0bbb96995140df0999b1fb3bd45b3d0976e92f94be042d63b8f5030d346f3d24fbadd9822a98690a6d90ba000d9188b3946807fd77735c65c2b1

Download Submit
C:\Users\Admin\Downloads\Q4iLzrSD.exe.part

Filesize
5KB

MD5
fe537a3346590c04d81d357e3c4be6e8

SHA1
b1285f1d8618292e17e490857d1bdf0a79104837

SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

Download Submit
C:\Users\Admin\Downloads\Rahack.QhQ_a87w.exe.part

Filesize
47KB

MD5
e3d273066db2c0e866f33c1731d8167f

SHA1
0804c4414d2a71d424203cdba7e8997e156573cf

SHA256
b0b04c73ace844e2bbd6689737c174a05571ab07388d5c53398d7b190ddd8a7e

SHA512
204a21eb27c516cb26401c9c3e41fb4ce63f4090e50480591e9dfd29ec9a12d94087cfea34021575e7f56040a1109ff16648773f80ea09d6654bf273d8fdc2d1

Download Submit
C:\Users\Admin\Downloads\Rahack.exe

Filesize
86KB

MD5
70089174cf0b97d4e4de889f03e97a7a

SHA1
c87c555b412929ab73562a048893bffc529436d9

SHA256
400c72ef312e3b46fe417aa82d6691d18a07c0708e94b6fa7b47934909d3db7c

SHA512
29c52942edf46ee11e4bae6837d632ed76372c13f1c5811546ea964bbb81e2076c596cd93936a34e7f4a45e0741c7ce90c7cf871a613747ebd329b174fb33538

Download Submit
C:\Users\Admin\Downloads\Remcos.exe

Filesize
92KB

MD5
fb598b93c04baafe98683dc210e779c9

SHA1
c7ccd43a721a508b807c9bf6d774344df58e752f

SHA256
c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4

SHA512
1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f

Download Submit
C:\Users\Admin\Downloads\RevengeRAT.e5p-RDlA.exe.part

Filesize
68KB

MD5
42b517dac8795ed060923111c700c0a5

SHA1
477e51a6023acde0d10ec0dbc03b8dd0a7bc8751

SHA256
e42c6594f8737442dc5fc06d2413bb14bce42c3dd9997155b45febd6959c086b

SHA512
0229aa0dc421466b4b88a4b9f836278b23c52e6aebfb809ba38f810efab4f2d99ac2e44089ef2c11bd86aa781c770503012537fa9da3b2a8b4d29616b5e769d2

Download Submit
C:\Users\Admin\Downloads\Sasser.0M64Trtb.A.exe.part

Filesize
104KB

MD5
ef1952b755ba912b9f60b2ed8dd68d30

SHA1
dcabadcf6f4a6079c8373ab2eb94b8ffeebd8d96

SHA256
b2fa6edaa5ffc51d12150424355a0c86ac9f46d7ec772d35ab8d9f4fe7996d91

SHA512
dd088f3ba5f97ae379d005ab252dd6aa98e10f81ef70d3029bfb4ece7bad5dde7558f25711c229bee6f5901bed980159fa82f217f281ce7476ee30e90a598729

Download Submit
C:\Users\Admin\Downloads\VanToM-Rat.r3REKWiJ.bat.part

Filesize
128KB

MD5
2ce809d49e8464e7d3b94798e05bd5f7

SHA1
3f319e3605f89025b623c87f72812db5088bd482

SHA256
9ee5c9647adfec3154aee324b44ed6ba7eb80d5a82a65784e8e7257e86a60e38

SHA512
8225c55655f36b37228588bc1ab1e975341e0bb2b12ddbb57dfbd888af94f5edf0f74d144595614b8a27af412a805b1e1dafa0e08dc7a4323cea6408d11906c5

Download Submit
C:\Users\Admin\Downloads\WarzoneRAT.lW-d2Qdi.exe.part

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
C:\Users\Admin\Downloads\metrofax.doc

Filesize
221KB

MD5
28e855032f83adbd2d8499af6d2d0e22

SHA1
6b590325e2e465d9762fa5d1877846667268558a

SHA256
b13b29772c29ccb412d6ab360ff38525836fcf0f65be637a7945a83a446dfd5e

SHA512
e401cbd41e044ff7d557f57960d50fb821244eaa97ce1218191d58e0935f6c069e6a0ff4788ed91ead279f36ba4eddfaa08dc3de01082c41dc9c2fc3c4b0ae34

Download Submit
C:\Users\Admin\Downloads\metrofax.doc:Zone.Identifier

Filesize
219B

MD5
e5f24e4738ab56b63e37d60740713730

SHA1
f6ccec09677e30380a8b805219d119269658989a

SHA256
9fd284bf8af89c4675649c6fec85efa8335f77419a93f58700f44caf9090eae3

SHA512
b4f25c52b67b8747c7091d7c45bf89fc75fcfc61746b9e5045b0cf2087aeb7c027e3fe754e28349de0edf61321f9e2f8ccc0bc4fba5f992186c2ea99f05e680f

Download Submit
C:\Users\Admin\Downloads\sPDE9I0T.exe.part

Filesize
3KB

MD5
6f5767ec5a9cc6f7d195dde3c3939120

SHA1
4605a2d0aae8fa5ec0b72973bea928762cc6d002

SHA256
59fe169797953f2046b283235fe80158ebf02ba586eabfea306402fba8473dae

SHA512
c0fbba6ecaef82d04157c5fcf458817bf11ce29cdaf3af6cac56724efcf4305565c6e665cdcf2106c675ba0574c60606be81d9baafe804fc7d2d3a50fed0baf6

Download Submit
C:\Windows\SysWOW64\remcos\logs.dat

Filesize
330B

MD5
5a2c855e4028d0063119a876c10250b1

SHA1
bc5039f77d680a7c5f622bce80332db0467de7ea

SHA256
b9c49d2244ea560514caaf45b8571c0898efd3a49b13375cc9e0d4f91abe9e45

SHA512
9276c102adc25f0b52f795943dcc4d80f8a7a60a66b8c07c258a2a7db56af5760198aabd3adb9e6c90aab6e7f851f29d98ae7d97bd9a451b2386fb9aa57cbad2

Download Submit
C:\Windows\SysWOW64\remcos\logs.dat

Filesize
362B

MD5
94aae80bb5e7bb56dd22c1bfa8b1f98b

SHA1
4e1c7c3868bef1e76bbfd03b404b218135530000

SHA256
89c0f23b92ea33b0db309c35623b7496a3de5c920ea89efd1a950ff6d306d839

SHA512
3fa4890604a7bd9a79d893d6bfc837d4fa3381cedf7f2650c9c28ad43dc93bc10f0f149150e1259f0775ce12a7422ac8cebd930cff4b661ac5d4e364898f61f6

Download Submit
C:\Windows\SysWOW64\remcos\logs.dat

Filesize
678B

MD5
d8777588197508dcdbce399b99ddce9c

SHA1
fc05c9f9ccb6657b12a3b38100683de6ac59e6fc

SHA256
964665167f4d467b8d20c221e7402f1ebfacc24f64021241241f43c45d674370

SHA512
bec3a5f25e2817c1305374ebb08d9f6c9da128e08ea06227ffba7e1c03248ba87d0eff76fe00b22018717049ce5b9a0de2fdf753a663a9d9fa538aa23fe3e7a2

Download Submit
C:\Windows\SysWOW64\remcos\logs.dat

Filesize
912B

MD5
c231f7f37a555034f6dab8651a28a993

SHA1
2b20ccf45c9eeb7c72078a995841a763b771850e

SHA256
af0b20d8450f8b64b332914c1af9617015ebaf468fcdaf7e109e400718a7bb6b

SHA512
444033d88dad46e8182106c48f8e25dc6617c6de37cbf6608e487e47ff0f7ab00846c202a743913123fa23ddc88249ca715f9f5d2f5341790772eb7b9f36369d

Download Submit
C:\Windows\SysWOW64\remcos\logs.dat

Filesize
1KB

MD5
3446224a1f4a8496ba03ef0d1dacb151

SHA1
d6d33c89d70b8e943c3adb28bc92411d7d3cd3a0

SHA256
b4a90d07f5ac8aba9efeeae084b5747f2dbc3adbeb93b4566ef30cc69084691a

SHA512
4b91f2df2bd2b38f9b1aca3fb549f5fa0c0e4265c7c47d884c818f19a6cc4ac26b96c80cfdcef3d7be12eba669a2ab2252d19f1acc1849f0d31262fa33f83221

Download Submit
C:\Windows\System32\spool\drivers\wmsncs.exe:Zone.Identifier

Filesize
237B

MD5
8d194598d4088e3b7a85c857a5bfee1a

SHA1
cf9bde5184ee24dcc66620968e66eb4cbf8d9529

SHA256
c0d90064636e1deadd0cef81e4059f04ac64d9a5f4af55f28f7a0120df4d7cb4

SHA512
0c104febef640c820994d8aca43bdc755f141ae5914d635293efcad0c4f26961c9c13a84542305c63e8529acf5751b1b9c590270d7697e407a294d7061ac4296

Download Submit
C:\Windows\system\msload.exe

Filesize
12KB

MD5
9a53cd6b36825e500254fca152e1193b

SHA1
d18642e2d45e8886abc6b0fc57f9624e4c7321c5

SHA256
c93d4fe28aac9d63003c10585d7db9b32950af33387e45f1cd35d3c5dc128f47

SHA512
c5de4f00198ab3d27a77ccb9e1ced649dbe1aef6d7f68b94832693825517d032aa8e21ccf95f952e726ef4b8540e7a0402373dec07e4dda2fc6b49db00246328

Download Submit
\Users\Admin\AppData\Local\Temp\8tr.exe

Filesize
178KB

MD5
c028f68109fd975e9aed790087fe1457

SHA1
8086b95ae4f58529e2941aa4c532d8c584af1024

SHA256
5c05db8164a6d51dd483cbe8eddb1d0c21aecf432ef75f5dc5a0a2fc0b711657

SHA512
d22c6fe16c97890866f12ca1c7ab98d6242f997e3b84a2ced243830079693d7896f9bf7374a4c54e6d4155fa838b91064794918e5840805f58c72e619a54da02

Download Submit
memory/472-835-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-1002-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-972-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-555-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-551-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-1224-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-612-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-564-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-705-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-1073-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/472-784-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1780-608-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/1780-599-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/1780-600-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2284-606-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/2284-770-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/2284-826-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/2284-986-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/2284-607-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2284-685-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/3236-890-0x000000001B580000-0x000000001B9AE000-memory.dmp

Filesize
4.2MB

Download
memory/3244-1207-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3412-700-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3716-766-0x0000000000400000-0x000000000041A400-memory.dmp

Filesize
105KB

Download
memory/3888-1238-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3980-1152-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1151-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1198-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1197-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1200-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1201-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1122-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3980-1202-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1196-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1134-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1135-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1136-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1137-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1138-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1139-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1140-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1141-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1142-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1143-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1144-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1145-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1146-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1147-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1148-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1154-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1149-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1150-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1199-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1160-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1153-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1155-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1156-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1157-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1158-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1159-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1161-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1164-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1165-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1167-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1168-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1169-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1170-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/3980-1166-0x0000000000750000-0x0000000000850000-memory.dmp

Filesize
1024KB

Download
memory/4028-1061-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download
memory/4028-1172-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download
memory/4028-1205-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4028-1121-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4028-1046-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/6580-17013-0x0000000000D30000-0x0000000000D9E000-memory.dmp

Filesize
440KB

Download
memory/7784-16790-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/7784-16794-0x0000000002030000-0x0000000002058000-memory.dmp

Filesize
160KB

Download
memory/7784-16789-0x0000000000920000-0x0000000000976000-memory.dmp

Filesize
344KB

Download
memory/8968-10642-0x0000000000010000-0x0000000000924000-memory.dmp

Filesize
9.1MB

Download
memory/9104-9752-0x00000000012D0000-0x00000000012EE000-memory.dmp

Filesize
120KB

Download