0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464

max time kernel
599s
max time network
604s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
capa-testfiles-master/0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe
Size 104KB
Sample260625-sbpepsc15l
SHA256 0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464
MD5 0775a35e939a14a382b562c95845cb50
SHA1 a3dfb5643c824ae0c3ba2b7f3efb266bfbf46b02
SHA512 05688926ecd0e5ab3767394a9751719de43454cae4dbb813697bc29200d20463461765e4f2661e91d0553a32ecad88e9f55cd1d28bf544d9f9b4151b345b448d
SSDEEP 1536:5wCKiKcgbtFF8d1eXyngejX81sc7/vyvigrqrii/y9QXON7dm5Jgw0:kSgF8reXynlj81GSiiKCON5m/F0
TLSH
T11DA32656BC605461F884003A223CEAABA6BDEC31F614FF72D7454D825D684B7C7E4EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
404	smss.exe
2404	smss.exe
5084	smss.exe
4420	smss.exe
780	smss.exe
1792	smss.exe
1980	smss.exe
1360	smss.exe
1104	smss.exe
3992	smss.exe
1076	smss.exe
3140	smss.exe
3956	smss.exe
4652	smss.exe
4736	smss.exe
260	smss.exe
2704	smss.exe
1736	smss.exe
4068	smss.exe
2664	smss.exe
3780	smss.exe
2008	smss.exe
2852	smss.exe
3528	smss.exe
3756	smss.exe
3972	smss.exe
2328	smss.exe
4476	smss.exe
4868	smss.exe
4108	smss.exe
4580	smss.exe
1020	smss.exe
4536	smss.exe
1876	smss.exe
4832	smss.exe
4156	smss.exe
2956	smss.exe
4456	smss.exe
3096	smss.exe
4012	smss.exe
5116	smss.exe
2220	smss.exe
744	smss.exe
3212	smss.exe
956	smss.exe
1448	smss.exe
1748	smss.exe
2672	smss.exe
4312	smss.exe
3164	smss.exe
3740	smss.exe
1520	smss.exe
4624	smss.exe
2696	smss.exe
4492	smss.exe
3812	smss.exe
2272	smss.exe
3972	smss.exe
3140	smss.exe
2356	smss.exe
3128	smss.exe
388	smss.exe
2596	smss.exe
5024	smss.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5024	3360	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ddc5b2bb04dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000474d7f6d2d312de1ad7c468a788bd64365cba399e96eb01e649bb2b962fcd33b000000000e8000000002000020000000b801139fd5195e3536575ea0edd4c5ab253a04b1e82d2852ada85a3215fea49920000000a5a67da000a3238dfdc5a47f6c70dbf31a32e4617d223cc3e3d889820656adfb40000000f721b1353f1de2bef1bcb3183caedcc5a33014ee0304226eaf9be727b8682918d0f3393832c2781433698379d71c587f9626a7366f6eec2bdbbf6d8aa75ee153	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "489164565"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1493119917"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa000000000200000000001066000000010000200000001c6b5bf299aa6f86057d61f0c24edaf25d64d219c1d8ec68c473e27969bdac02000000000e80000000020000200000007b4c176e56d4945028143a6bbb79821e1abe5fe1c9a70c0d40a47b3e98d9206d20000000de373c7bf18f2df9cfa04f2ba53952239a9ecdcf09ffe8b1a1e4a4dfe81d37f340000000350b098eb7e4fae743e0a49d654b1f6d8a74641c4a70825c7850b58c19ab4e3b8cc49cb807d3af4f49154fed73d6cc26f6d990ade45eebe36c0765cef0b0db37	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31261875"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f759c0bb04dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa000000000200000000001066000000010000200000009d71e4be152e0723ea0540d84b138d901890dbda849deb575a795c198b534408000000000e80000000020000200000002e43295dfc07fcc72503cde153debf0afde0dd6165442c64e436c840824e795a20000000e9d282592fdb1e824726253ebfc819a28593a3e8ce726d9f32c078850bcd385f40000000bae66223472df541bedfa1b544c68d556f5fe8829b40271c40053515351c9baaee958642c97f4f88ad7f854d626f1bc523df073d214af43aa4bfd924b9a89c27	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa000000000200000000001066000000010000200000005feb4725c9343c1f3152fe0c39c5bf5f102a7c6a6d843d6384c1e2ae5d8ebc89000000000e8000000002000020000000923248e71c85aa081e3c1de3a599ad3b4a65cb241659d779d4e41c8a7b99505820000000356d43f4aaa4bc722e3d5f8564611d0e18022c2bb1c72ad01a793401092f9f864000000016921a0d19014eff4f20c4d413cc5ba7f5e275521324e1881edd9f0525cf115c10bea3a1e96c851716b9723ee453b156130b102fa3451565890ec098c749e34b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa000000000200000000001066000000010000200000006c8607d2612dde3a5fd3631070f54e05ab96429e42558f0aa898afa3cb4ae0c7000000000e8000000002000020000000320948cc0d65275b0906e9dfd886c93d11a43b177eedeea183309100fe7ff11a20000000e171ef923497d9a2b1c0ee4ee8012c77649f5206c6f03f7fb2b325989093705540000000f54d20ab26644ffdd5b8fce319aa0c23892fd14c91187b9bd28f6f75e1cb62f29d579f0b0bae4acff5b03eb527a46caac53fedbdfead3323a07d004f8047d82e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa000000000200000000001066000000010000200000000239916eef5596d800312b4a80840eecda494a5fffb5a189414c07c82afde7cf000000000e800000000200002000000029ec97e7d93252e536f647128ccb419be5078abb681fd04cf2392f26e31db3fe20000000c461e32435201e9ac99e274c62791a4ef07c87a5e60bdc92dac7ecf2b90a532340000000930914de77ae224972a10bc65235dc343baa596584d5d09ef702dd7aae87b6942245cf8e4b880be6235c8f6edaa456ef852f7ea9c2a92bfb582c5c6b6ada0053	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{83A73CD0-70A6-11F1-BC3D-5E09A530FE4D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f430b6bb04dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c762d1bb04dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31261875"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000558ab33d0546925e4a7546f34e3b172c8092da65dd7b18335777846793647158000000000e800000000200002000000022339099fe6a2387f41b3be2f9cda8479409c9098f9c583c5c6f3df898de050820000000f3758dcbbdef9baab79c46989362646bfba3509b80dd3878f75dfd6f3e2731a04000000081f7ab14ecf8094f1e1945b8f4ea691d3a44116b59f5323033f9787272c3feba67324fbcce2ce70835ee583141d395a412823f4d1bb3da5a7a73ded9ec47d7e1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000f07690b78a80b6e113c19dda4839b34b78c5a188887f127210eafa5de338c3eb000000000e800000000200002000000072a72a90f0246e9893251a65b4f3e8fe85fc703b9af55baecbf1d9c536cf3b2520000000cd8410a680aa7775224ce1261619b6318bfbdcd08143d28958cf4ef0cb74a15b40000000eaf6850412445ab14e3284bd4508a077df27467c95d54bc83061d6eb456cc3ac044268be93e29830b4a029b2fdd6ee7f6b790b3f0a3c906953da4603d20ea2b7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40308fcabb04dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000e76e13759f7f218e77ca0b96d98b647ec29db8902ced15f73cdcb77aca258aa9000000000e80000000020000200000008a7a6281f3143f752ad0e9ae2afe403249736681e2922c1d572f414721661205200000003d84fd033a822dd08dfaf548cd1be3023d464d10717f003217cc1ead2271e332400000003517cedb861640f665a1a5c9a3c3be2be883cb7d7249292544809078272c178e04dfc9deae4488ff316d7c75af1055708ab6e08462415c303804eaa1b9037951	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa000000000200000000001066000000010000200000002bcf682a280803401f0bd10400a860d74d64a4bc83659ba9dae7328ffcefa0b7000000000e8000000002000020000000ba819d339d2efaf25000a3660655d025895dabaa87c1b22cf8d6c170c223d8822000000045fcff79d74c1fcda7dd43168db77990caf0c9feedeb621196e75d93104f81f54000000073267e76414f8d93adb62e30bb3f805dbed03528fe4257e7181710b2e7d1bc24fb1c7c57b99cb54df83bbb477eca706c089c43a83cb6ce85ab685d75da9f16e8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60eefabcbb04dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509ec2c3bb04dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08926c7bb04dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0aff7cdbb04dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04792b9bb04dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1483744703"	IEXPLORE.EXE

Runs regedit.exe 1 IoCs

pid	Process
4588	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3360	0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe
3360	0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
4332	IEXPLORE.EXE
4332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 2480	3360	0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe	86
PID 2480 wrote to memory of 404	2480	cmd.exe	88
PID 2480 wrote to memory of 3460	2480	cmd.exe	89
PID 2480 wrote to memory of 2404	2480	cmd.exe	90
PID 2480 wrote to memory of 3732	2480	cmd.exe	94
PID 2480 wrote to memory of 5084	2480	cmd.exe	95
PID 2480 wrote to memory of 228	2480	cmd.exe	96
PID 2480 wrote to memory of 4420	2480	cmd.exe	97
PID 2480 wrote to memory of 1752	2480	cmd.exe	98
PID 2480 wrote to memory of 780	2480	cmd.exe	99
PID 2480 wrote to memory of 5000	2480	cmd.exe	104
PID 2480 wrote to memory of 1792	2480	cmd.exe	105
PID 2480 wrote to memory of 3772	2480	cmd.exe	110
PID 2480 wrote to memory of 1980	2480	cmd.exe	111
PID 3360 wrote to memory of 4588	3360	0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe	112
PID 2448 wrote to memory of 4332	2448	iexplore.exe	115
PID 2480 wrote to memory of 4752	2480	cmd.exe	116
PID 2480 wrote to memory of 1360	2480	cmd.exe	117
PID 2480 wrote to memory of 2628	2480	cmd.exe	118
PID 2480 wrote to memory of 1104	2480	cmd.exe	119
PID 2480 wrote to memory of 4872	2480	cmd.exe	120
PID 2480 wrote to memory of 3992	2480	cmd.exe	121
PID 2480 wrote to memory of 4416	2480	cmd.exe	122
PID 2480 wrote to memory of 1076	2480	cmd.exe	123
PID 2480 wrote to memory of 4788	2480	cmd.exe	124
PID 2480 wrote to memory of 3140	2480	cmd.exe	125
PID 2480 wrote to memory of 4288	2480	cmd.exe	126
PID 2480 wrote to memory of 3956	2480	cmd.exe	127
PID 2480 wrote to memory of 1156	2480	cmd.exe	128
PID 2480 wrote to memory of 4652	2480	cmd.exe	129
PID 2480 wrote to memory of 5024	2480	cmd.exe	130
PID 2480 wrote to memory of 4736	2480	cmd.exe	131
PID 2480 wrote to memory of 1388	2480	cmd.exe	132
PID 2480 wrote to memory of 260	2480	cmd.exe	133
PID 2480 wrote to memory of 3508	2480	cmd.exe	134
PID 2480 wrote to memory of 2704	2480	cmd.exe	135
PID 2480 wrote to memory of 3644	2480	cmd.exe	137
PID 2480 wrote to memory of 1736	2480	cmd.exe	138
PID 2480 wrote to memory of 3336	2480	cmd.exe	139
PID 2480 wrote to memory of 4068	2480	cmd.exe	140
PID 2480 wrote to memory of 3488	2480	cmd.exe	141
PID 2480 wrote to memory of 2664	2480	cmd.exe	142
PID 2480 wrote to memory of 4596	2480	cmd.exe	143
PID 2480 wrote to memory of 3780	2480	cmd.exe	144
PID 2480 wrote to memory of 2896	2480	cmd.exe	145
PID 2480 wrote to memory of 2008	2480	cmd.exe	146
PID 2480 wrote to memory of 2804	2480	cmd.exe	147
PID 2480 wrote to memory of 2852	2480	cmd.exe	148
PID 2480 wrote to memory of 4852	2480	cmd.exe	149
PID 2480 wrote to memory of 3528	2480	cmd.exe	150
PID 2480 wrote to memory of 1296	2480	cmd.exe	151
PID 2480 wrote to memory of 3756	2480	cmd.exe	152
PID 2480 wrote to memory of 4148	2480	cmd.exe	153
PID 2480 wrote to memory of 3972	2480	cmd.exe	154
PID 2480 wrote to memory of 832	2480	cmd.exe	155
PID 2480 wrote to memory of 2328	2480	cmd.exe	156
PID 2480 wrote to memory of 724	2480	cmd.exe	157
PID 2480 wrote to memory of 4476	2480	cmd.exe	158
PID 2480 wrote to memory of 1908	2480	cmd.exe	159
PID 2480 wrote to memory of 4868	2480	cmd.exe	160
PID 2480 wrote to memory of 388	2480	cmd.exe	161
PID 2480 wrote to memory of 4108	2480	cmd.exe	162
PID 2480 wrote to memory of 4856	2480	cmd.exe	163
PID 2480 wrote to memory of 4580	2480	cmd.exe	164

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3652	attrib.exe
768	attrib.exe
448	attrib.exe
3504	attrib.exe
4272	attrib.exe
4600	attrib.exe
5036	attrib.exe
1776	attrib.exe
1140	attrib.exe
4752	attrib.exe
4756	attrib.exe
1388	attrib.exe
3384	attrib.exe
4368	attrib.exe
3420	attrib.exe
4260	attrib.exe
4980	attrib.exe
228	attrib.exe
3488	attrib.exe
1180	attrib.exe
3864	attrib.exe
4384	attrib.exe
392	attrib.exe
2300	attrib.exe
4220	attrib.exe
404	attrib.exe
2956	attrib.exe
1928	attrib.exe
4028	attrib.exe
1296	attrib.exe
3388	attrib.exe
4560	attrib.exe
5080	attrib.exe
2316	attrib.exe
4292	attrib.exe
4300	attrib.exe
4780	attrib.exe
4440	attrib.exe
2608	attrib.exe
4636	attrib.exe
748	attrib.exe
4288	attrib.exe
4856	attrib.exe
956	attrib.exe
1496	attrib.exe
1576	attrib.exe
1724	attrib.exe
832	attrib.exe
1244	attrib.exe
1132	attrib.exe
5096	attrib.exe
1004	attrib.exe
3436	attrib.exe
3320	attrib.exe
3776	attrib.exe
4528	attrib.exe
4468	attrib.exe
2984	attrib.exe
1752	attrib.exe
4460	attrib.exe
2960	attrib.exe
4460	attrib.exe
1852	attrib.exe
3732	attrib.exe

C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe
"C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\0ce3bfa972ced61884ae7c1d77c7d4c45e17c7d767e669610cf2ef72b636b464.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.tmp.cmd "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:404
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2404
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:5084
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:228
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4420
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:780
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:1792
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1980
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:1360
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1104
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3992
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:1076
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4788
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3140
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3956
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4652
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4736
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:260
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2704
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:1736
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4068
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2664
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3780
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2008
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2852
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3528
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1296
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3756
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4148
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2328
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:724
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4476
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4868
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:388
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4108
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4580
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:1020
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4536
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:1876
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4832
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4156
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2956
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4456
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4588
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4012
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:5116
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2220
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:744
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3212
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:956
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1448
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1852
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:5044
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2672
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:4312
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3164
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3740
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:1520
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4624
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:392
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2696
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1244
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4492
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3812
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2272
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3972
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3140
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2356
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:3128
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:388
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:2596
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - Executes dropped EXE
    PID:5024
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4512
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:992
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:780
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3772
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:944
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:708
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4440
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:812
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:3864
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2996
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3872
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4616
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:972
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1244
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3688
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4892
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5036
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:5024
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1020
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:208
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:780
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1680
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3716
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3616
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3308
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:696
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:764
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4192
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4952
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2336
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4260
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4388
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:744
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:360
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3248
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3800
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:3652
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:884
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:448
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    - Views/modifies file attributes
    PID:4028
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:4292
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CAPA-T~1\0CE3BF~1.EXE"
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
    3⤵
    PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 528
  2⤵
  - Program crash
  PID:5024
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\win5.tmp
  2⤵
  - Modifies Internet Explorer settings
  - Runs regedit.exe
  PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3360 -ip 3360
1⤵
PID:4064

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1096

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 2f6c150684fa285eca7c4d5218a3fde2e8dd8544401ef8eb5d0c4e31d41965cc
MD5 b0c51d7e1c63d044e8d07b5bfb7b2493
SHA1 46fdd3e0b8bf064c0c23f218f686235ce1be8342
SHA512 2818990322bd5f735cb14243eddfcb54abf07142969d029c674418c11fae7643ff6a5a5b8e8ef0197e943855b227afc1695b31222e506736c88f3c9fe7e3d05e
TLSH
T11FF0DCA64438EC8667405C9D5ECC0F33B830B4B3929917AAE23C959D8A615B4AF2B439
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 c25a39211be33fe76bd1e167d767157c341e6005d185fa00e6974522c7250de4
MD5 45632e5240ffb53f0eeb6b6d11e1d9d0
SHA1 2d320a42f9d951acce617e0fae8cc1b2ae892342
SHA512 b2535f0838b088d62c2ac2cb235aba3f976c87f47cfda866dd515e343ae2282300c075a0a7cf2f1ec5a2ccd48236ffbf1d28013de585ff66a2cd06c55b1d9e49
TLSH
T1AEE0C03811F7812EF1E4E03467D575218469F0271529B2F42ED48B04E703A009C03925
MD5 SHA1 SHA512 TLSH

Submit Download

dnserror[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2CAWFFZ1\dnserror[1]
Size 2KB
SHA256 acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993
MD5 2dc61eb461da1436f5d22bce51425660
SHA1 e1b79bcab0f073868079d807faec669596dc46c1
SHA512 a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d
TLSH
T197515121ACF499131132D585ACF6FE14FDF28153C305A888B0AD12AB6FBAF898D07129
MD5 SHA1 SHA512 TLSH

Submit Download

NewErrorPageTemplate[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EBYGJJYO\NewErrorPageTemplate[1]
Size 1KB
SHA256 77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
MD5 dfeabde84792228093a5a270352395b6
SHA1 e41258c9576721025926326f76063c2305586f76
SHA512 e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd
TLSH
T1DD31678DDA02D053F3BB1C2A37A22711EA28454759569B387BE47704CFFA43D6211F8D
MD5 SHA1 SHA512 TLSH

Submit Download

errorPageStrings[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EBYGJJYO\errorPageStrings[1]
Size 4KB
SHA256 a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
MD5 d65ec06f21c379c87040b83cc1abac6b
SHA1 208d0a0bb775661758394be7e4afb18357e46c8b
SHA512 8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
SSDEEP 96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
TLSH
T1DAA1536D95DA1A22254245B3060FD2E6AAC50D949320D3B8770CD37F378C6ECD2FA7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EBYGJJYO\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

down[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KF3E8S94\down[1]
Size 748B
SHA256 39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
MD5 c4f558c4c8b56858f15c09037cd6625a
SHA1 ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA512 d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44
TLSH
T14F0199B5859E790C591F1F65D83E483EBC412FFD8C6071977396DA13179518C88CE1C8
MD5 SHA1 SHA512 TLSH

Submit Download

httpErrorPagesScripts[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KF3E8S94\httpErrorPagesScripts[1]
Size 11KB
SHA256 65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
MD5 9234071287e637f85d721463c488704c
SHA1 cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA512 87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
SSDEEP 192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
TLSH
T14E4220ED3512067687CF182B2A2B934CBC7904551E22EDA0846C88D1B5F5FDDF5ABBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.tmp.cmd

Path C:\Users\Admin\AppData\Local\Temp\1.tmp.cmd
Size 168B
SHA256 624acac79fdcfe30592f5321b4ab73d360f393dbcdbe8daa50fcce63c710f5dc
MD5 e7efc2c945a798b4dab3fe50f1524592
SHA1 0bb937ccd89e40c91c0e58b376873ef909fe805b
SHA512 e75840979404587aa15fd4d1e46707c33e32dca086ca72c7666045e14191e29857d06dc8ba737e69925c71b2e2d6a5ee3b63c36ecd2f32ae515f85a985d8f257
TLSH
T1E4C08CCF5A9C0C75AC650AB8BE29100A226EF0B7CA380146B4E22084D20A388CA94193
MD5 SHA1 SHA512 TLSH

Submit Download

smss.exe

Path C:\Users\Admin\AppData\Local\Temp\smss.exe
Size 18KB
SHA256 4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
MD5 b3624dd758ccecf93a1226cef252ca12
SHA1 fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA512 c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
SSDEEP 384:PVhNH/TqNcx+5tTAjtn3bPcPwoeGULZbiWBlWjVw:PVhZXx+5tTetLVohULZJgw
TLSH
T102826B43B685807AF7A6273506332F365F39F9222F04A1E76F51491AAD34AC0D8B671F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win5.tmp

Path C:\Users\Admin\AppData\Local\Temp\win5.tmp
Size 240B
SHA256 6aa561c0cd6879efa55a085e9020c4827f4e51e8b44902e72b908d06bb454c32
MD5 ee926df00618b73a370f2dbcbe19ebeb
SHA1 eb775efca19c657d4cc02d21190db4f522ae750d
SHA512 6b4d1f2d897b6876755d1a6370f849d1241bbb9d462a5347b0b157bb4b7efe80c0d171e14e0277bd72dfbcdf31cdc055e500341a6e0c444513cb47cddecaaf54
TLSH
T12ED0A7407919822BE2F137142A4566503BE473DF78D6CADCCC8A0351A84BF40D67F2DE
MD5 SHA1 SHA512 TLSH

Submit Download