d0596d6ec9df77425df57135e143609cb95e2d5817dbf59632081a3940d3bc61

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

systemuser.exe
Size

16.2MB
MD5

b46ff65472aba689f7cdd2b81cd42142
SHA1

16251509795e6126f8883e97180c197f713dc88c
SHA256

d0596d6ec9df77425df57135e143609cb95e2d5817dbf59632081a3940d3bc61
SHA512

be7c2989ef10225183aa6fe7f356c1b96b7bed3e2cd99a7d99b80d89337b6666efd0c1a75227505f1e3fa2e3ab99dcf67c1bf933549724b5c695b6c44cc090f3
SSDEEP

393216:t4A662tOh7skhs2n5nXaBIteAhOBq1FS8pbGReR9gyLp/dh:t4AotuI2sNI9S8p7RCyLp/dh

Score

7^/10

discovery pyinstaller

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2104	MSUpdate.exe
2936	ChromeUpdate.exe
1700	MSUpdate.exe
1408	Process not Found

Loads dropped DLL 4 IoCs

pid	Process
3028	systemuser.exe
2936	ChromeUpdate.exe
1700	MSUpdate.exe
1408	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
536	tasklist.exe
2820	tasklist.exe
2728	tasklist.exe
2820	tasklist.exe
2468	tasklist.exe
2788	tasklist.exe
2352	tasklist.exe
1052	tasklist.exe
1556	tasklist.exe
1824	tasklist.exe
2848	tasklist.exe
1476	tasklist.exe
2920	tasklist.exe
1084	tasklist.exe
928	tasklist.exe
1916	tasklist.exe
2068	tasklist.exe
3044	tasklist.exe
2424	tasklist.exe
536	tasklist.exe
1652	tasklist.exe
112	tasklist.exe
2384	tasklist.exe
2892	tasklist.exe
2608	tasklist.exe
1072	tasklist.exe
1680	tasklist.exe
2572	tasklist.exe
3068	tasklist.exe
2768	tasklist.exe
2156	tasklist.exe
968	tasklist.exe
1604	tasklist.exe
1600	tasklist.exe
2696	tasklist.exe
2088	tasklist.exe
2232	tasklist.exe
596	tasklist.exe
2660	tasklist.exe
2532	tasklist.exe
1832	tasklist.exe
1764	tasklist.exe
2300	tasklist.exe
2204	tasklist.exe
3024	tasklist.exe
2856	tasklist.exe
1600	tasklist.exe
776	tasklist.exe
2476	tasklist.exe
2628	tasklist.exe
1484	tasklist.exe
2600	tasklist.exe
1104	tasklist.exe
2196	tasklist.exe
1696	tasklist.exe
1900	tasklist.exe
2460	tasklist.exe
2156	tasklist.exe
2852	tasklist.exe
2564	tasklist.exe
436	tasklist.exe
2716	tasklist.exe
1368	tasklist.exe
2900	tasklist.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000a000000012262-7.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
1908	timeout.exe
1592	timeout.exe
2764	timeout.exe
320	timeout.exe
2352	timeout.exe
2872	timeout.exe
2420	timeout.exe
1780	timeout.exe
1904	timeout.exe
2564	timeout.exe
2960	timeout.exe
2852	timeout.exe
3044	timeout.exe
2980	timeout.exe
2988	timeout.exe
1716	timeout.exe
2276	timeout.exe
1724	timeout.exe
948	timeout.exe
2312	timeout.exe
1376	timeout.exe
2544	timeout.exe
2560	timeout.exe
2892	timeout.exe
1204	timeout.exe
596	timeout.exe
2096	timeout.exe
884	timeout.exe
2228	timeout.exe
3032	timeout.exe
1376	timeout.exe
1600	timeout.exe
3020	timeout.exe
2088	timeout.exe
2280	timeout.exe
2592	timeout.exe
2404	timeout.exe
2788	timeout.exe
2040	timeout.exe
1932	timeout.exe
2428	timeout.exe
2484	timeout.exe
2372	timeout.exe
2984	timeout.exe
1152	timeout.exe
2648	timeout.exe
2904	timeout.exe
564	timeout.exe
1480	timeout.exe
876	timeout.exe
1532	timeout.exe
1484	timeout.exe
2244	timeout.exe
1612	timeout.exe
928	timeout.exe
2804	timeout.exe
3060	timeout.exe
1992	timeout.exe
1828	timeout.exe
3028	timeout.exe
2304	timeout.exe
3044	timeout.exe
1356	timeout.exe
3016	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2936	ChromeUpdate.exe
2936	ChromeUpdate.exe
2936	ChromeUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	ChromeUpdate.exe
Token: SeDebugPrivilege	264	tasklist.exe
Token: SeDebugPrivilege	2384	tasklist.exe
Token: SeDebugPrivilege	1832	tasklist.exe
Token: SeDebugPrivilege	2040	tasklist.exe
Token: SeDebugPrivilege	2852	tasklist.exe
Token: SeDebugPrivilege	2880	tasklist.exe
Token: SeDebugPrivilege	2900	tasklist.exe
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	2768	tasklist.exe
Token: SeDebugPrivilege	1152	tasklist.exe
Token: SeDebugPrivilege	2772	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	2756	tasklist.exe
Token: SeDebugPrivilege	2900	tasklist.exe
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	2768	tasklist.exe
Token: SeDebugPrivilege	2696	tasklist.exe
Token: SeDebugPrivilege	2124	tasklist.exe
Token: SeDebugPrivilege	1104	tasklist.exe
Token: SeDebugPrivilege	2960	tasklist.exe
Token: SeDebugPrivilege	1456	tasklist.exe
Token: SeDebugPrivilege	536	tasklist.exe
Token: SeDebugPrivilege	1556	tasklist.exe
Token: SeDebugPrivilege	1640	tasklist.exe
Token: SeDebugPrivilege	2952	tasklist.exe
Token: SeDebugPrivilege	2820	tasklist.exe
Token: SeDebugPrivilege	2088	tasklist.exe
Token: SeDebugPrivilege	2204	tasklist.exe
Token: SeDebugPrivilege	1824	tasklist.exe
Token: SeDebugPrivilege	1764	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	2424	tasklist.exe
Token: SeDebugPrivilege	1072	tasklist.exe
Token: SeDebugPrivilege	2192	tasklist.exe
Token: SeDebugPrivilege	1052	tasklist.exe
Token: SeDebugPrivilege	1084	tasklist.exe
Token: SeDebugPrivilege	1696	tasklist.exe
Token: SeDebugPrivilege	1600	tasklist.exe
Token: SeDebugPrivilege	2052	tasklist.exe
Token: SeDebugPrivilege	2564	tasklist.exe
Token: SeDebugPrivilege	2228	tasklist.exe
Token: SeDebugPrivilege	860	tasklist.exe
Token: SeDebugPrivilege	2468	tasklist.exe
Token: SeDebugPrivilege	2232	tasklist.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	2280	tasklist.exe
Token: SeDebugPrivilege	2112	tasklist.exe
Token: SeDebugPrivilege	1572	tasklist.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	2036	tasklist.exe
Token: SeDebugPrivilege	536	tasklist.exe
Token: SeDebugPrivilege	1556	tasklist.exe
Token: SeDebugPrivilege	1880	tasklist.exe
Token: SeDebugPrivilege	3012	tasklist.exe
Token: SeDebugPrivilege	2820	tasklist.exe
Token: SeDebugPrivilege	2088	tasklist.exe
Token: SeDebugPrivilege	2204	tasklist.exe
Token: SeDebugPrivilege	1824	tasklist.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	2848	tasklist.exe
Token: SeDebugPrivilege	2816	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2104	3028	systemuser.exe	31
PID 3028 wrote to memory of 2104	3028	systemuser.exe	31
PID 3028 wrote to memory of 2104	3028	systemuser.exe	31
PID 3028 wrote to memory of 2936	3028	systemuser.exe	32
PID 3028 wrote to memory of 2936	3028	systemuser.exe	32
PID 3028 wrote to memory of 2936	3028	systemuser.exe	32
PID 2104 wrote to memory of 1700	2104	MSUpdate.exe	33
PID 2104 wrote to memory of 1700	2104	MSUpdate.exe	33
PID 2104 wrote to memory of 1700	2104	MSUpdate.exe	33
PID 2936 wrote to memory of 1648	2936	ChromeUpdate.exe	35
PID 2936 wrote to memory of 1648	2936	ChromeUpdate.exe	35
PID 2936 wrote to memory of 1648	2936	ChromeUpdate.exe	35
PID 1648 wrote to memory of 2236	1648	cmd.exe	37
PID 1648 wrote to memory of 2236	1648	cmd.exe	37
PID 1648 wrote to memory of 2236	1648	cmd.exe	37
PID 1648 wrote to memory of 264	1648	cmd.exe	38
PID 1648 wrote to memory of 264	1648	cmd.exe	38
PID 1648 wrote to memory of 264	1648	cmd.exe	38
PID 1648 wrote to memory of 1936	1648	cmd.exe	39
PID 1648 wrote to memory of 1936	1648	cmd.exe	39
PID 1648 wrote to memory of 1936	1648	cmd.exe	39
PID 1648 wrote to memory of 2444	1648	cmd.exe	40
PID 1648 wrote to memory of 2444	1648	cmd.exe	40
PID 1648 wrote to memory of 2444	1648	cmd.exe	40
PID 1648 wrote to memory of 2384	1648	cmd.exe	41
PID 1648 wrote to memory of 2384	1648	cmd.exe	41
PID 1648 wrote to memory of 2384	1648	cmd.exe	41
PID 1648 wrote to memory of 1948	1648	cmd.exe	42
PID 1648 wrote to memory of 1948	1648	cmd.exe	42
PID 1648 wrote to memory of 1948	1648	cmd.exe	42
PID 1648 wrote to memory of 1604	1648	cmd.exe	43
PID 1648 wrote to memory of 1604	1648	cmd.exe	43
PID 1648 wrote to memory of 1604	1648	cmd.exe	43
PID 1648 wrote to memory of 1832	1648	cmd.exe	44
PID 1648 wrote to memory of 1832	1648	cmd.exe	44
PID 1648 wrote to memory of 1832	1648	cmd.exe	44
PID 1648 wrote to memory of 2544	1648	cmd.exe	45
PID 1648 wrote to memory of 2544	1648	cmd.exe	45
PID 1648 wrote to memory of 2544	1648	cmd.exe	45
PID 1648 wrote to memory of 1724	1648	cmd.exe	46
PID 1648 wrote to memory of 1724	1648	cmd.exe	46
PID 1648 wrote to memory of 1724	1648	cmd.exe	46
PID 1648 wrote to memory of 2040	1648	cmd.exe	47
PID 1648 wrote to memory of 2040	1648	cmd.exe	47
PID 1648 wrote to memory of 2040	1648	cmd.exe	47
PID 1648 wrote to memory of 1080	1648	cmd.exe	48
PID 1648 wrote to memory of 1080	1648	cmd.exe	48
PID 1648 wrote to memory of 1080	1648	cmd.exe	48
PID 1648 wrote to memory of 596	1648	cmd.exe	49
PID 1648 wrote to memory of 596	1648	cmd.exe	49
PID 1648 wrote to memory of 596	1648	cmd.exe	49
PID 1648 wrote to memory of 2852	1648	cmd.exe	50
PID 1648 wrote to memory of 2852	1648	cmd.exe	50
PID 1648 wrote to memory of 2852	1648	cmd.exe	50
PID 1648 wrote to memory of 2564	1648	cmd.exe	51
PID 1648 wrote to memory of 2564	1648	cmd.exe	51
PID 1648 wrote to memory of 2564	1648	cmd.exe	51
PID 1648 wrote to memory of 324	1648	cmd.exe	52
PID 1648 wrote to memory of 324	1648	cmd.exe	52
PID 1648 wrote to memory of 324	1648	cmd.exe	52
PID 1648 wrote to memory of 2880	1648	cmd.exe	53
PID 1648 wrote to memory of 2880	1648	cmd.exe	53
PID 1648 wrote to memory of 2880	1648	cmd.exe	53
PID 1648 wrote to memory of 2884	1648	cmd.exe	54

C:\Users\Admin\AppData\Local\Temp\systemuser.exe
"C:\Users\Admin\AppData\Local\Temp\systemuser.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Roaming\MSUpdate.exe
  "C:\Users\Admin\AppData\Roaming\MSUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Users\Admin\AppData\Roaming\MSUpdate.exe
    "C:\Users\Admin\AppData\Roaming\MSUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1700
- C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe
  "C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1F34.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp1F34.tmp.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2236
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:264
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2444
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2384
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1948
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1604
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1832
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2544
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1724
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2040
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1080
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:596
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2852
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2564
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:324
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2880
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2884
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3044
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2900
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2872
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2828
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2892
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2100
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2264
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2768
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2804
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2636
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1152
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2044
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1356
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2772
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2324
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:596
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2352
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2500
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2788
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2756
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2776
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3044
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2900
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2872
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3016
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2892
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2100
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2680
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2768
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2804
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2652
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2696
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2752
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2472
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2124
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2912
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2372
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1104
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2420
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2536
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2960
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2780
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1908
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1456
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1172
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1780
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:536
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2888
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1904
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1556
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1728
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:948
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1640
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1464
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2120
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2952
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2140
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2984
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2820
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2400
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2388
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2088
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2080
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2636
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2204
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1368
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3060
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1824
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2176
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1752
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1460
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1492
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1528
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:608
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1376
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2196
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:3052
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:876
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2424
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2440
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1152
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1072
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1952
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1532
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2192
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:264
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1644
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1052
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1680
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:696
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1084
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1476
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2304
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1696
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1692
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2544
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1600
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1724
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2392
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2052
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1080
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2560
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2564
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2856
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:324
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2228
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2736
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2764
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:860
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:3032
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2656
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2468
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2900
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2744
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2232
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2812
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2648
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2644
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2768
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1624
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2280
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2696
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2616
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2112
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2124
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:940
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1572
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:692
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2980
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2300
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2956
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1992
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2036
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1172
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:320
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:536
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2888
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2988
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1556
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1728
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1484
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1880
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2996
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2428
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3012
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2840
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2244
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2820
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2400
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2160
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2088
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2080
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1828
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2204
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1368
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1740
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1824
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2176
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1292
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2608
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1656
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1120
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1528
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:608
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1592
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2848
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1576
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2488
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2816
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2600
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1716
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1072
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1952
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1608
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2444
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:976
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1160
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1680
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1744
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1684
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1476
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1948
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:524
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1564
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1836
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1600
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2476
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1404
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2548
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:596
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2500
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2564
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2788
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:112
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3028
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2572
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2720
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2580
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2660
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:3024
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2252
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2896
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2828
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2892
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2628
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2060
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:336
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:776
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2612
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2280
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2156
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2372
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1612
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:3068
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2824
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1552
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2920
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:756
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2960
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2532
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1048
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:928
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1992
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1128
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1172
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1652
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1168
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1296
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1900
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1388
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1672
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:3008
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2184
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3020
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2200
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1240
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2448
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1916
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:372
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2916
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2728
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1088
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2088
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1204
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2152
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2592
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:3064
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1720
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2904
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:436
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1292
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2608
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:628
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1376
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2312
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2928
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1704
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1064
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2716
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1152
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2424
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2216
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:376
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1936
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1620
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:960
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:908
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2460
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:916
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1472
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1084
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1604
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2304
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1692
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2024
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1356
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2068
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1724
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2040
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2476
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1976
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2352
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:596
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2856
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2776
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:112
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2688
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2576
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:3044
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2884
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2872
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:3024
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2876
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1688
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2896
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2828
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2804
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2628
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2060
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2116
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:776
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2612
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2912
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2156
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2708
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2420
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2536
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1300
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2964
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2920
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:756
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2336
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:968
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2532
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:564
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:928
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2036
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2096
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1172
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2692
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1168
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1296
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1364
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1388
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1484
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2120
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1480
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2428
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2140
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:3000
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2448
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2820
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1916
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2400
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2224
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1932
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2080
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:3060
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1204
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1368
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1824
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1720
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2904
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1488
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1292
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1656
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:608
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1376
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2196
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:3052
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2404
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2600
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2816
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:884
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2424
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1072
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1716
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1936
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:976
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:960
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:908
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1744
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2484
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2596
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1400
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:1684
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1604
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1948
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:524
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2344
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2832
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2276
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:1600
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1896
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2852
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:1080
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2560
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2228
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      Enumerates processes with tasklist
      PID:2856
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2776
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      PID:2736
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2936"
      4⤵
      PID:2788
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2576
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI21042\python312.dll

Filesize
6.6MB

MD5
b243d61f4248909bc721674d70a633de

SHA1
1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc

SHA256
93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7

SHA512
10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1F34.tmp.bat

Filesize
286B

MD5
8ce4be2dbe957c9b33f508976fcf3257

SHA1
08326a3967bc7d0dd4cf3771474279b050544842

SHA256
04d6277b15ab5817d805232c527649cabdb092bd031095cb8bfadf0bd0c9a0b8

SHA512
672febaba32466c6342fbf5996e759114e862eda3175567a6f2878a00ceaa1025d9d5fbc991ce106e88e1ce367a8a8e2f219b0fee16e99fa1a35de355eac4237

Download Submit
C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe

Filesize
5.6MB

MD5
8df87acac0fec3cc3a0583d5bd322503

SHA1
023731a7643fb6eddc473e5b7553ca482e9f8acd

SHA256
4adf744fb30dfa98fd07c72f06f818ec049973670e4c81ac077790d388b3d498

SHA512
b763a29a836abb1ed83fdfa24a882e4d6e0b21cb47ace87e024b64613d4bc5831afd50f44e75f94ca67d9a87dfc676abdf40ebdbb74d091b551b35a67ed707bb

Download Submit
C:\Users\Admin\AppData\Roaming\MSUpdate.exe

Filesize
10.5MB

MD5
79d19e7b20c0a9f3ac172041dcf84c97

SHA1
2e8a9c7d1aac017c1fabae50677e5bedea55c16d

SHA256
6080208516fa0312f72202ff528cf3ae055fcec32049191c8b4043bdb52bf072

SHA512
1d3fa42566c332501300da43e462a68341f9fc5aa5328d1b57cbb947e9b3e3eaa86d3368f52e82e3294fff63dc53587fda070967fa9a533dc4f9497a71e72e35

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
memory/2936-32-0x0000000000C70000-0x0000000001212000-memory.dmp

Filesize
5.6MB

Download
memory/2936-278-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/2936-288-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/2936-968-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/3028-1-0x00000000011A0000-0x00000000021D0000-memory.dmp

Filesize
16.2MB

Download
memory/3028-0-0x000007FEF60D3000-0x000007FEF60D4000-memory.dmp

Filesize
4KB

Download