Overview

overview

10

Static

static

3

95f15fd116...8N.exe

windows7-x64

10

95f15fd116...8N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/11/2024, 22:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe

  • Size

    219KB

  • MD5

    f05afbacd6238d9dad8f18d2d729d4f0

  • SHA1

    3bc7df7205dba517b12876077f294f6eaae3ed48

  • SHA256

    95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28

  • SHA512

    dff0e244436f27062ee21408157d8106147c81ccc90af44a662e32d945c4e3d8f406f1c9913ab2a84230d288256b4656a32cb9b437cce6f21638672d889c39be

  • SSDEEP

    3072:JtZAFD5xUZzvdG4fpr6TXkapdxiJJi/DolAFHoHQOX+VjvF54VCDcHTxPaVaJJ4u:J6fUZ7dTprgjxiuoHbacdJ4KHTOe

Score
10/10
njratdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 45 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 27 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 23 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 23 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
    "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
      "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3488
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Executes dropped EXE
          PID:2800
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Executes dropped EXE
          PID:2152
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3828
        • C:\Users\Admin\AppData\Local\Temp\core.exe
          "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 2936 C:\Users\Admin\AppData\Roaming\svchost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2216
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
          4⤵
            PID:3140
      • C:\Users\Admin\AppData\Local\Temp\core.exe
        "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 3004 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
          "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4404
          • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
            "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
            4⤵
              PID:4088
            • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
              "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
              4⤵
                PID:464
              • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3568
              • C:\Users\Admin\AppData\Local\Temp\core.exe
                "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 3568 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3532
                • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                  "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                  5⤵
                  • Checks computer location settings
                  • Suspicious use of SetThreadContext
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2000
                  • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                    "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2020
                  • C:\Users\Admin\AppData\Local\Temp\core.exe
                    "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 2020 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                    6⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3720
                    • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                      "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                      7⤵
                      • Checks computer location settings
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4076
                      • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                        "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2276
                      • C:\Users\Admin\AppData\Local\Temp\core.exe
                        "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 2276 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2152
                        • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                          "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                          9⤵
                          • Checks computer location settings
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1952
                          • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                            "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                            10⤵
                              PID:4812
                            • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                              "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                              10⤵
                              • System Location Discovery: System Language Discovery
                              PID:364
                            • C:\Users\Admin\AppData\Local\Temp\core.exe
                              "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 364 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                              10⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2028
                              • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                11⤵
                                • Checks computer location settings
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                PID:704
                                • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                  "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                  12⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1476
                                • C:\Users\Admin\AppData\Local\Temp\core.exe
                                  "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 1476 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1232
                                  • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                    "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1440
                                    • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                      "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                      14⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1808
                                    • C:\Users\Admin\AppData\Local\Temp\core.exe
                                      "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 1808 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                      14⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4524
                                      • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                        "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                        15⤵
                                        • Checks computer location settings
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3012
                                        • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                          "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                          16⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1524
                                        • C:\Users\Admin\AppData\Local\Temp\core.exe
                                          "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 1524 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                          16⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4832
                                          • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                            "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                            17⤵
                                            • Checks computer location settings
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4028
                                            • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                              "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                              18⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2440
                                            • C:\Users\Admin\AppData\Local\Temp\core.exe
                                              "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 2440 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                              18⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2028
                                              • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                19⤵
                                                • Checks computer location settings
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1220
                                                • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                  20⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5040
                                                • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 5040 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                  20⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3544
                                                  • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                    21⤵
                                                    • Checks computer location settings
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1760
                                                    • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                      22⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4936
                                                    • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 4936 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                      22⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3516
                                                      • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                        23⤵
                                                        • Checks computer location settings
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2712
                                                        • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                          24⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3636
                                                        • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 3636 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                          24⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3220
                                                          • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                            25⤵
                                                            • Checks computer location settings
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2764
                                                            • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                              26⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4628
                                                            • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 4628 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                              26⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1932
                                                              • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                27⤵
                                                                • Checks computer location settings
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1220
                                                                • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                  28⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4652
                                                                • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 4652 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                  28⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1848
                                                                  • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                    29⤵
                                                                    • Checks computer location settings
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:3432
                                                                    • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                      30⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4088
                                                                    • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 4088 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                      30⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4164
                                                                      • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                        31⤵
                                                                        • Checks computer location settings
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry class
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4128
                                                                        • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                          32⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2084
                                                                        • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 2084 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                          32⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5032
                                                                          • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                            33⤵
                                                                            • Checks computer location settings
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:704
                                                                            • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                              34⤵
                                                                                PID:1444
                                                                              • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                34⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4964
                                                                              • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 4964 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                34⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4396
                                                                                • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                  35⤵
                                                                                  • Checks computer location settings
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1576
                                                                                  • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                    36⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2324
                                                                                  • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 2324 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                    36⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2800
                                                                                    • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                      37⤵
                                                                                      • Checks computer location settings
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Modifies registry class
                                                                                      PID:4740
                                                                                      • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                        38⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2152
                                                                                      • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 2152 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                        38⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1948
                                                                                        • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                          39⤵
                                                                                          • Checks computer location settings
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry class
                                                                                          PID:1716
                                                                                          • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                            40⤵
                                                                                              PID:3788
                                                                                            • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                              40⤵
                                                                                                PID:4572
                                                                                              • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                                40⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4088
                                                                                              • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 4088 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                40⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:3816
                                                                                                • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                                  41⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Modifies registry class
                                                                                                  PID:1920
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                                    42⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3528
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 3528 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                    42⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:216
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                                      43⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry class
                                                                                                      PID:3468
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                                        44⤵
                                                                                                          PID:2008
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe"
                                                                                                          44⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:3888
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\core.exe" -woohoo 3888 C:\Users\Admin\AppData\Local\Temp\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe
                                                                                                          44⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:4876
                                                                                                        • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                                          44⤵
                                                                                                            PID:3688
                                                                                                      • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                                        42⤵
                                                                                                          PID:4360
                                                                                                    • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                                      40⤵
                                                                                                        PID:1524
                                                                                                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                                    38⤵
                                                                                                      PID:760
                                                                                                • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                                  36⤵
                                                                                                    PID:2864
                                                                                              • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                                34⤵
                                                                                                  PID:2540
                                                                                            • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                              "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                              32⤵
                                                                                                PID:1804
                                                                                          • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                            "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                            30⤵
                                                                                              PID:3044
                                                                                        • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                          28⤵
                                                                                            PID:2336
                                                                                      • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                        26⤵
                                                                                          PID:1668
                                                                                    • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                      24⤵
                                                                                        PID:2276
                                                                                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                    22⤵
                                                                                      PID:2736
                                                                                • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                  20⤵
                                                                                    PID:960
                                                                              • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                                18⤵
                                                                                  PID:4628
                                                                            • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                              "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                              16⤵
                                                                                PID:3384
                                                                          • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                            "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                            14⤵
                                                                              PID:4836
                                                                        • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                          12⤵
                                                                            PID:1072
                                                                      • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                        10⤵
                                                                          PID:880
                                                                    • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                      8⤵
                                                                        PID:1432
                                                                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                    6⤵
                                                                      PID:4364
                                                                • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                  4⤵
                                                                    PID:2636
                                                              • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3"
                                                                2⤵
                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2164
                                                            • C:\Windows\system32\AUDIODG.EXE
                                                              C:\Windows\system32\AUDIODG.EXE 0x3d8 0x510
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3812

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Create or Modify System Process

                                                            1
                                                            T1543

                                                            Windows Service

                                                            1
                                                            T1543.003

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Netsh Helper DLL

                                                            1
                                                            T1546.007

                                                            Privilege Escalation

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Create or Modify System Process

                                                            1
                                                            T1543

                                                            Windows Service

                                                            1
                                                            T1543.003

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Netsh Helper DLL

                                                            1
                                                            T1546.007

                                                            Defense Evasion

                                                            Impair Defenses

                                                            1
                                                            T1562

                                                            Disable or Modify System Firewall

                                                            1
                                                            T1562.004

                                                            Modify Registry

                                                            1
                                                            T1112

                                                            Credential Access

                                                            Discovery

                                                            Query Registry

                                                            1
                                                            T1012

                                                            System Information Discovery

                                                            2
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            Lateral Movement

                                                            Collection

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28N.exe.log
                                                              Filesize

                                                              223B

                                                              MD5

                                                              cde6529abeea500fb852f29ba0da6115

                                                              SHA1

                                                              45f2f48492417ae6a0eade8aaa808d3d1d760743

                                                              SHA256

                                                              d7f4964443470b6729865676d76f5f1f416da633033071c34ea5eb19cdea53b5

                                                              SHA512

                                                              c95fa7faf6a90f32060dba70f79c4d66c68d6eec587306fb98f36fc3ba5d377ebf9dabf47298b71db208fb10f7ccb4e0ed82236c8f26bcc746552588bbb38234

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\Efeito legal (SONY VEGAS).mp3
                                                              Filesize

                                                              28KB

                                                              MD5

                                                              c956b3f8fbfc2f148d8b45b7c967043d

                                                              SHA1

                                                              4ece63b00abbdd0667bdb6b009d336a1d3899862

                                                              SHA256

                                                              d02179d45970ee749b23563a497e6ae1bbba9c5369a5aabf002e156ff1a1443a

                                                              SHA512

                                                              bff8b4caa8b9a287c2bd361a9401cda33df9f622d4af94ae6c91fb988ccad833395155b01d75defad1d0c7748f31d60563cb37804d6a59b9ac0274eec2e5513b

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\core.exe
                                                              Filesize

                                                              219KB

                                                              MD5

                                                              f05afbacd6238d9dad8f18d2d729d4f0

                                                              SHA1

                                                              3bc7df7205dba517b12876077f294f6eaae3ed48

                                                              SHA256

                                                              95f15fd116eee290c928be8cc7e7e826f104c395442d49852a99884b7e2c2b28

                                                              SHA512

                                                              dff0e244436f27062ee21408157d8106147c81ccc90af44a662e32d945c4e3d8f406f1c9913ab2a84230d288256b4656a32cb9b437cce6f21638672d889c39be

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
                                                              Filesize

                                                              394B

                                                              MD5

                                                              22d5c0100591f43b19b972535f9dca7b

                                                              SHA1

                                                              f1f8a95a40b392edb23edc9588be3b0fcdf7daaa

                                                              SHA256

                                                              b2b2abcbd86dae3c1b8a49c75aa71ae5b8bb3ea00e84ec333670b2571019c0ed

                                                              SHA512

                                                              3ddb5b473f4f04aa7851ef65ff2f3d76e42bf5a248a9bff9828ffff6d0ed8b25f6936778e0ac1a910d6c4392654137abee68da43c4401a06bf12f1d127a84ec3

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
                                                              Filesize

                                                              112B

                                                              MD5

                                                              4b6e905d5cd0ab91c15124840f427437

                                                              SHA1

                                                              0efd0186451054cf27957665e78ab7c72bb388fb

                                                              SHA256

                                                              e8e1035f214c83de825dbe1238261ed611433c9d2a10a24dd0c378782423c74d

                                                              SHA512

                                                              6d2cc81a045860a3a7c353980bed105c5cb9c2077b0b28617c310cb442d0b15513d7826fe57bc3e8938ba23676841d3d3db479dadc2228b2628b4700375ac5bc

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.gJ2164
                                                              Filesize

                                                              111B

                                                              MD5

                                                              6a53568c6e362d9ebe8a5d74ef17f8c3

                                                              SHA1

                                                              0424cd8241d9d2f28dde3afd6eb80d32fbbf0d2f

                                                              SHA256

                                                              04b892b9144779a08b80d6a4c9543b6befeea12cc1f8ba3cec782157ad299d05

                                                              SHA512

                                                              d6aea623dfe2c3db3f72dd9a520c4cb475f4216d78af6a6e71a66e54ad4ef7076b42850fe192c5e8d1d38d15a0cb4c7b52a4a581377498b9006751859e04a25e

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock
                                                              Filesize

                                                              18B

                                                              MD5

                                                              b362344c9d848f270f041fc33a325f76

                                                              SHA1

                                                              cf6833361d16fc64eb02cb5ad4c09a5cfd438ccd

                                                              SHA256

                                                              c1f72adbe8265d8e99a300ce2859ebf0cc6b66ee526a2d97abd35fc40d745cd8

                                                              SHA512

                                                              0d13ecc52b2974fa767680dcf2ac01883c445baf936c721a93c067efd83134cbd388c8b2025571fcb75fca48963e4471370d27549682991b42358e8231983ae8

                                                              Download Submit

                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
                                                              Filesize

                                                              394B

                                                              MD5

                                                              4fa8a985be5977f7357cc2b70a9d0348

                                                              SHA1

                                                              c17db225707b1e99855f9dc52689243bf4adefe2

                                                              SHA256

                                                              8e48e254ce94b64a0de583775a9dd92e8cf5fa245a69f1af01e674a83a033cb1

                                                              SHA512

                                                              1d8921a07b54cb514a8a8a0ab331498fa5120a618e8d774145fc8e87847dc02e36f8b0894d22eeb6bec415861097f844795883b43fddd2d9f8b988a931a4e7bc

                                                              Download Submit

                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
                                                              Filesize

                                                              862B

                                                              MD5

                                                              048a86a178a40336e88c96eccec85bbc

                                                              SHA1

                                                              20d5adb82e9e1d3721e7eae9decad47707e79cd6

                                                              SHA256

                                                              82e6d0e5e74c7388094eeaa927dd315bfae97a1863137778e507cb5803dd566a

                                                              SHA512

                                                              b20e4c4ba730b13c75fa3671f2d967d1bce4387ca0260aa79636dcf3c11f82101975c001cdb8eccc4ab77ca4562369e08045826397b20e10dfd4123b3d016a32

                                                              Download Submit

                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch
                                                              Filesize

                                                              516B

                                                              MD5

                                                              fdffba92850f6a392709cd98c22120dd

                                                              SHA1

                                                              271c8a8fa810692b8e6fe2c1308c4fd05b899e8f

                                                              SHA256

                                                              f932af6cdecc6bed22df374b460e7d28a80415550e26dda9e070f49f8fbcd5f0

                                                              SHA512

                                                              bffcc75bc885be148fabf0c71f3067d6465c0060dde0db6e7b211ffa73931d6f96bdda3c70aa9c6ca3de2f678ea37e7ddc8ca27a4e62738bb4863ac87fd6ccb2

                                                              Download Submit

                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch
                                                              Filesize

                                                              862B

                                                              MD5

                                                              81056790a2ba68019480407e102fdae1

                                                              SHA1

                                                              b5ff75aed0c3b419d8dbd92c87cc5b072b0b3933

                                                              SHA256

                                                              3167af24e7f470c1b607651edda102bdb0a71edfe7ead6adbf091ed3899cd757

                                                              SHA512

                                                              9e970982e079f2b551c5b5b958744e26f8f3283beae0090cf5fa7edcd9c40bc0576e027aa0da93f468aabbdf612b359c67dfd603254ab775015de0add93f0dac

                                                              Download Submit

                                                            • memory/436-0-0x0000000074F12000-0x0000000074F13000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/436-2-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/436-33-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/436-1-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/1432-196-0x00007FFA50B80000-0x00007FFA50B98000-memory.dmp

                                                              Filesize

                                                              96KB

                                                              Download

                                                            • memory/1432-193-0x00007FFA497D0000-0x00007FFA49804000-memory.dmp

                                                              Filesize

                                                              208KB

                                                              Download

                                                            • memory/1432-189-0x00007FF63F000000-0x00007FF63F0F8000-memory.dmp

                                                              Filesize

                                                              992KB

                                                              Download

                                                            • memory/1432-195-0x00007FFA39DF0000-0x00007FFA3A0A6000-memory.dmp

                                                              Filesize

                                                              2.7MB

                                                              Download

                                                            • memory/1432-197-0x00007FFA4EA30000-0x00007FFA4EA47000-memory.dmp

                                                              Filesize

                                                              92KB

                                                              Download

                                                            • memory/1432-198-0x00007FFA498D0000-0x00007FFA498E1000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/2164-132-0x00007FF63F000000-0x00007FF63F0F8000-memory.dmp

                                                              Filesize

                                                              992KB

                                                              Download

                                                            • memory/2164-136-0x00007FFA4EA30000-0x00007FFA4EA47000-memory.dmp

                                                              Filesize

                                                              92KB

                                                              Download

                                                            • memory/2164-149-0x00007FFA40250000-0x00007FFA40261000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/2164-140-0x00007FFA49070000-0x00007FFA4908D000-memory.dmp

                                                              Filesize

                                                              116KB

                                                              Download

                                                            • memory/2164-148-0x00007FFA414C0000-0x00007FFA414D1000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/2164-143-0x00007FFA38590000-0x00007FFA39640000-memory.dmp

                                                              Filesize

                                                              16.7MB

                                                              Download

                                                            • memory/2164-147-0x00007FFA449D0000-0x00007FFA449E1000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/2164-133-0x00007FFA497D0000-0x00007FFA49804000-memory.dmp

                                                              Filesize

                                                              208KB

                                                              Download

                                                            • memory/2164-135-0x00007FFA50B80000-0x00007FFA50B98000-memory.dmp

                                                              Filesize

                                                              96KB

                                                              Download

                                                            • memory/2164-145-0x00007FFA44FB0000-0x00007FFA44FD1000-memory.dmp

                                                              Filesize

                                                              132KB

                                                              Download

                                                            • memory/2164-137-0x00007FFA498D0000-0x00007FFA498E1000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/2164-146-0x00007FFA449F0000-0x00007FFA44A08000-memory.dmp

                                                              Filesize

                                                              96KB

                                                              Download

                                                            • memory/2164-139-0x00007FFA49610000-0x00007FFA49621000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/2164-144-0x00007FFA40270000-0x00007FFA402B1000-memory.dmp

                                                              Filesize

                                                              260KB

                                                              Download

                                                            • memory/2164-138-0x00007FFA49630000-0x00007FFA49647000-memory.dmp

                                                              Filesize

                                                              92KB

                                                              Download

                                                            • memory/2164-141-0x00007FFA48980000-0x00007FFA48991000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/2164-134-0x00007FFA39DF0000-0x00007FFA3A0A6000-memory.dmp

                                                              Filesize

                                                              2.7MB

                                                              Download

                                                            • memory/2164-142-0x00007FFA39640000-0x00007FFA3984B000-memory.dmp

                                                              Filesize

                                                              2.0MB

                                                              Download

                                                            • memory/2636-123-0x00007FFA50B80000-0x00007FFA50B98000-memory.dmp

                                                              Filesize

                                                              96KB

                                                              Download

                                                            • memory/2636-122-0x00007FFA39DF0000-0x00007FFA3A0A6000-memory.dmp

                                                              Filesize

                                                              2.7MB

                                                              Download

                                                            • memory/2636-124-0x00007FFA4EA30000-0x00007FFA4EA47000-memory.dmp

                                                              Filesize

                                                              92KB

                                                              Download

                                                            • memory/2636-125-0x00007FFA498D0000-0x00007FFA498E1000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/2636-120-0x00007FF63F000000-0x00007FF63F0F8000-memory.dmp

                                                              Filesize

                                                              992KB

                                                              Download

                                                            • memory/2636-121-0x00007FFA497D0000-0x00007FFA49804000-memory.dmp

                                                              Filesize

                                                              208KB

                                                              Download

                                                            • memory/3004-54-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/3004-3-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                              Download

                                                            • memory/3004-5-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                              Download

                                                            • memory/3004-4-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                              Download

                                                            • memory/3004-8-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/3004-16-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/3140-76-0x00007FFA39DF0000-0x00007FFA3A0A6000-memory.dmp

                                                              Filesize

                                                              2.7MB

                                                              Download

                                                            • memory/3140-80-0x00007FFA4EA30000-0x00007FFA4EA47000-memory.dmp

                                                              Filesize

                                                              92KB

                                                              Download

                                                            • memory/3140-70-0x00007FF63F000000-0x00007FF63F0F8000-memory.dmp

                                                              Filesize

                                                              992KB

                                                              Download

                                                            • memory/3140-81-0x00007FFA498D0000-0x00007FFA498E1000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/3140-79-0x00007FFA50B80000-0x00007FFA50B98000-memory.dmp

                                                              Filesize

                                                              96KB

                                                              Download

                                                            • memory/3140-71-0x00007FFA497D0000-0x00007FFA49804000-memory.dmp

                                                              Filesize

                                                              208KB

                                                              Download

                                                            • memory/3920-21-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/3920-101-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/3920-30-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/3920-22-0x0000000074F10000-0x00000000754C1000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                              Download

                                                            • memory/4364-174-0x00007FFA4EA30000-0x00007FFA4EA47000-memory.dmp

                                                              Filesize

                                                              92KB

                                                              Download

                                                            • memory/4364-170-0x00007FF63F000000-0x00007FF63F0F8000-memory.dmp

                                                              Filesize

                                                              992KB

                                                              Download

                                                            • memory/4364-172-0x00007FFA39DF0000-0x00007FFA3A0A6000-memory.dmp

                                                              Filesize

                                                              2.7MB

                                                              Download

                                                            • memory/4364-173-0x00007FFA50B80000-0x00007FFA50B98000-memory.dmp

                                                              Filesize

                                                              96KB

                                                              Download

                                                            • memory/4364-175-0x00007FFA498D0000-0x00007FFA498E1000-memory.dmp

                                                              Filesize

                                                              68KB

                                                              Download

                                                            • memory/4364-171-0x00007FFA497D0000-0x00007FFA49804000-memory.dmp

                                                              Filesize

                                                              208KB

                                                              Download