chimera | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

user interaction
yes
max time kernel
195s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo
Sample260806-3dkjmscl4t

Score

10^/10

banker botnet discovery chimera danabot persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

danabot

51.178.195.151
51.222.39.81
149.255.35.125
38.68.50.179
51.77.7.204

rsa_pubkey.plain

Signatures

Family: Chimera 64 IoCs

Ransomware which infects local and network files, often distributed via Dropbox links.

ransomware chimera

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\osfFPA\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\eu-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\uk-ua\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files\Crashpad\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ru-ru\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe

Family: Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Chimera Ransomware Loader DLL 1 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

resource	yara_rule
behavioral1/memory/6768-561-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Danabot x86 payload 1 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

resource	yara_rule
behavioral1/files/0x00080000000245ff-430.dat	family_danabot

Renames multiple (2727) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
138	4228	rundll32.exe
140	4228	rundll32.exe
141	4228	rundll32.exe
147	4228	rundll32.exe
150	4228	rundll32.exe
151	4228	rundll32.exe
152	4228	rundll32.exe
159	4228	rundll32.exe
161	4228	rundll32.exe
162	4228	rundll32.exe
163	4228	rundll32.exe
183	4228	rundll32.exe
402	4228	rundll32.exe

Executes dropped EXE 15 IoCs

pid	Process
428	msload.exe
5316	winsrv.exe
5572	BITSPROXY.EXE
5840	MPREXE.EXE
5220	COMP.EXE
5148	CRYPTTPMEKSVC.EXE
1100	CHAKRA.EXE
5972	scr.scr
5952	DBNMPNTW.EXE
6924	msload.exe
6940	msload.exe
6332	msload.exe
7740	msload.exe
7772	msload.exe
8180	msload.exe

Loads dropped DLL 3 IoCs

pid	Process
4700	regsvr32.exe
4700	regsvr32.exe
4228	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CRYPTTPMEKSVC = "C:\\WINDOWS\\CRYPTTPMEKSVC.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	winsrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	BITSPROXY.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	MPREXE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	MPREXE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BITSPROXY = "C:\\WINDOWS\\BITSPROXY.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	scr.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	scr.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	scr.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	BITSPROXY.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	scr.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	CHAKRA.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CHAKRA = "C:\\WINDOWS\\CHAKRA.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	winsrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	BITSPROXY.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	BITSPROXY.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	CHAKRA.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	CHAKRA.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPREXE = "C:\\WINDOWS\\MPREXE.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DBNMPNTW = "C:\\WINDOWS\\DBNMPNTW.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsrv = "c:\\windows\\system\\winsrv.exe"	winsrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	MPREXE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	CHAKRA.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scr = "c:\\windows\\system\\scr.scr"	winsrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe"	ColorBug.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\COMP = "C:\\WINDOWS\\COMP.EXE"	Opaserv.l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\LoadManager = "c:\\windows\\system\\msload.exe"	MPREXE.EXE

Drops desktop.ini file(s) 27 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Searches\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	rundll32.exe
File opened for modification	C:\Program Files\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	rundll32.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	rundll32.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	rundll32.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
160	bot.whatismyipaddress.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_checkbox_partialselected-default_18.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\plugin.js	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\url-polyfill.min.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\ui-strings.js	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-down_32.svg	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\svgCheckboxUnselected.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\ui-strings.js	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\ui-strings.js	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\it-it\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\virgo_mycomputer_folder_icon.svg	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-100.png	rundll32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\8.jpg	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Paint_PDP.xml	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-tool-view.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js	rundll32.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\YOUR_FILES_ARE_ENCRYPTED.HTML	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\da-dk\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_de_135x40.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README.txt	rundll32.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-dark-disabled_32.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\spectrum_spinner.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-125.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-focus_32.svg	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-white_scale-100.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-hover.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ui-strings.js	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-100_contrast-white.png	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\meBoot.min.js	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_selectlist_checkmark_18.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js	rundll32.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\CRYPTTPMEKSVC.EXE	Opaserv.l.exe
File opened for modification	C:\WINDOWS\MPREXE.EXE	BITSPROXY.EXE
File opened for modification	C:\WINDOWS\MPREXE.EXE	MPREXE.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File opened for modification	\??\c:\windows\system\scr.scr	CRYPTTPMEKSVC.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	CRYPTTPMEKSVC.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File created	C:\WINDOWS\DBNMPNTW.EXE	Opaserv.l.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	BITSPROXY.EXE
File opened for modification	\??\c:\windows\system\scr.scr	MPREXE.EXE
File opened for modification	\??\c:\windows\MPREXE.EXE	scr.scr
File opened for modification	\??\c:\windows\system\msload.exe	DBNMPNTW.EXE
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File created	C:\WINDOWS\BITSPROXY.EXE	Opaserv.l.exe
File created	\??\c:\windows\system\msload.exe	Opaserv.l.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	winsrv.exe
File created	\??\c:\windows\system\winsrv.exe	MPREXE.EXE
File opened for modification	C:\WINDOWS\MPREXE.EXE	scr.scr
File created	C:\WINDOWS\MPREXE.EXE	scr.scr
File opened for modification	\??\c:\windows\system\winsrv.exe	DBNMPNTW.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	CHAKRA.EXE
File opened for modification	\??\c:\windows\system\scr.scr	msload.exe
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File opened for modification	\??\c:\windows\system\msload.exe	Opaserv.l.exe
File opened for modification	C:\WINDOWS\COMP.EXE	Opaserv.l.exe
File opened for modification	C:\WINDOWS\MPREXE.EXE	winsrv.exe
File created	\??\c:\windows\system\winsrv.exe	BITSPROXY.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	scr.scr
File created	\??\c:\windows\system\winsrv.exe	scr.scr
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\system\scr.scr	Opaserv.l.exe
File created	C:\WINDOWS\MPREXE.EXE	winsrv.exe
File opened for modification	\??\c:\windows\system\scr.scr	winsrv.exe
File created	\??\c:\windows\system\msload.exe	MPREXE.EXE
File opened for modification	\??\c:\windows\system\scr.scr	CHAKRA.EXE
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\system\msload.exe	msload.exe
File created	C:\WINDOWS\CRYPTTPMEKSVC.EXE	Opaserv.l.exe
File opened for modification	\??\c:\windows\system\msload.exe	scr.scr
File opened for modification	\??\c:\windows\system\msload.exe	COMP.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File opened for modification	\??\c:\windows\system\scr.scr	msload.exe
File opened for modification	\??\c:\windows\system\winsrv.exe	msload.exe
File created	C:\WINDOWS\MPREXE.EXE	Opaserv.l.exe
File created	\??\c:\windows\system\winsrv.exe	Opaserv.l.exe
File created	\??\c:\windows\system\scr.scr	MPREXE.EXE
File opened for modification	C:\WINDOWS\MPREXE.EXE	CHAKRA.EXE
File created	\??\c:\windows\system\msload.exe	CHAKRA.EXE
File opened for modification	\??\c:\windows\MPREXE.EXE	CRYPTTPMEKSVC.EXE
File opened for modification	\??\c:\windows\system\scr.scr	DBNMPNTW.EXE
File opened for modification	\??\c:\windows\MPREXE.EXE	msload.exe
File opened for modification	\??\c:\windows\system\msload.exe	winsrv.exe
File opened for modification	C:\WINDOWS\CHAKRA.EXE	Opaserv.l.exe
File created	C:\WINDOWS\CHAKRA.EXE	Opaserv.l.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	winsrv.exe
File opened for modification	\??\c:\windows\MPREXE.EXE	MPREXE.EXE
File created	\??\c:\windows\system\msload.exe	scr.scr
File created	\??\c:\windows\system\winsrv.exe	CHAKRA.EXE
File opened for modification	\??\c:\windows\system\msload.exe	CHAKRA.EXE
File opened for modification	\??\c:\windows\system\winsrv.exe	MPREXE.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4868	4660	WerFault.exe	121
4716	4228	WerFault.exe	128

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CHAKRA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opaserv.l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HawkEye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "35"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305322452775883"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{27A33733-BE4C-497D-854E-75C433D075CA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe
2852	Opaserv.l.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	Opaserv.l.exe
Token: SeDebugPrivilege	428	msload.exe
Token: SeShutdownPrivilege	428	msload.exe
Token: SeDebugPrivilege	5316	winsrv.exe
Token: SeDebugPrivilege	5572	BITSPROXY.EXE
Token: SeDebugPrivilege	5840	MPREXE.EXE
Token: SeDebugPrivilege	5220	COMP.EXE
Token: SeShutdownPrivilege	5220	COMP.EXE
Token: SeDebugPrivilege	5148	CRYPTTPMEKSVC.EXE
Token: SeShutdownPrivilege	5148	CRYPTTPMEKSVC.EXE
Token: SeDebugPrivilege	1100	CHAKRA.EXE
Token: SeDebugPrivilege	5972	scr.scr
Token: SeDebugPrivilege	5952	DBNMPNTW.EXE
Token: SeShutdownPrivilege	5952	DBNMPNTW.EXE
Token: SeDebugPrivilege	6924	msload.exe
Token: SeShutdownPrivilege	6924	msload.exe
Token: SeDebugPrivilege	6940	msload.exe
Token: SeShutdownPrivilege	6940	msload.exe
Token: SeDebugPrivilege	6332	msload.exe
Token: SeShutdownPrivilege	6332	msload.exe
Token: SeDebugPrivilege	7740	msload.exe
Token: SeShutdownPrivilege	7740	msload.exe
Token: SeDebugPrivilege	7772	msload.exe
Token: SeShutdownPrivilege	7772	msload.exe
Token: SeDebugPrivilege	8180	msload.exe
Token: SeShutdownPrivilege	8180	msload.exe
Token: SeDebugPrivilege	6768	HawkEye.exe
Token: SeSystemtimePrivilege	1428	Time.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5380	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 2632	3240	msedge.exe	87
PID 3240 wrote to memory of 4736	3240	msedge.exe	88
PID 3240 wrote to memory of 5108	3240	msedge.exe	89
PID 3240 wrote to memory of 5108	3240	msedge.exe	89
PID 3240 wrote to memory of 5108	3240	msedge.exe	89
PID 3240 wrote to memory of 3784	3240	msedge.exe	90
PID 3240 wrote to memory of 3784	3240	msedge.exe	90
PID 3240 wrote to memory of 2448	3240	msedge.exe	91
PID 3240 wrote to memory of 1052	3240	msedge.exe	92
PID 3240 wrote to memory of 2448	3240	msedge.exe	91
PID 3240 wrote to memory of 2448	3240	msedge.exe	91
PID 3240 wrote to memory of 1052	3240	msedge.exe	92
PID 3240 wrote to memory of 1052	3240	msedge.exe	92
PID 3240 wrote to memory of 1048	3240	msedge.exe	94
PID 3240 wrote to memory of 1048	3240	msedge.exe	94
PID 3240 wrote to memory of 1048	3240	msedge.exe	94
PID 3240 wrote to memory of 4548	3240	msedge.exe	95
PID 3240 wrote to memory of 4548	3240	msedge.exe	95
PID 3240 wrote to memory of 4548	3240	msedge.exe	95
PID 3240 wrote to memory of 3020	3240	msedge.exe	98
PID 3240 wrote to memory of 3316	3240	msedge.exe	99
PID 3240 wrote to memory of 3020	3240	msedge.exe	98
PID 3240 wrote to memory of 3316	3240	msedge.exe	99
PID 3240 wrote to memory of 2984	3240	msedge.exe	101
PID 3240 wrote to memory of 2592	3240	msedge.exe	102
PID 3240 wrote to memory of 3428	3240	msedge.exe	103
PID 3240 wrote to memory of 2592	3240	msedge.exe	102
PID 3240 wrote to memory of 3428	3240	msedge.exe	103
PID 3240 wrote to memory of 3428	3240	msedge.exe	103
PID 3240 wrote to memory of 4820	3240	msedge.exe	104
PID 3240 wrote to memory of 2884	3240	msedge.exe	105
PID 3240 wrote to memory of 1036	3240	msedge.exe	106
PID 3240 wrote to memory of 1180	3240	msedge.exe	111
PID 3240 wrote to memory of 3176	3240	msedge.exe	118
PID 3240 wrote to memory of 3176	3240	msedge.exe	118
PID 4660 wrote to memory of 4700	4660	DanaBot.exe	124
PID 4700 wrote to memory of 4228	4700	regsvr32.exe	128
PID 3240 wrote to memory of 3024	3240	msedge.exe	129
PID 3240 wrote to memory of 3024	3240	msedge.exe	129
PID 2852 wrote to memory of 4936	2852	Opaserv.l.exe	132
PID 2852 wrote to memory of 3728	2852	Opaserv.l.exe	133
PID 2852 wrote to memory of 5024	2852	Opaserv.l.exe	134
PID 2852 wrote to memory of 3200	2852	Opaserv.l.exe	135
PID 2852 wrote to memory of 1968	2852	Opaserv.l.exe	137
PID 3200 wrote to memory of 1668	3200	NET.exe	142
PID 5024 wrote to memory of 1900	5024	NET.exe	143
PID 4936 wrote to memory of 1504	4936	NET.exe	144
PID 3728 wrote to memory of 3492	3728	NET.exe	145
PID 1968 wrote to memory of 2968	1968	NET.exe	146
PID 2852 wrote to memory of 428	2852	Opaserv.l.exe	147
PID 428 wrote to memory of 2220	428	msload.exe	149
PID 428 wrote to memory of 3768	428	msload.exe	152
PID 428 wrote to memory of 4568	428	msload.exe	156
PID 428 wrote to memory of 1360	428	msload.exe	159
PID 428 wrote to memory of 4192	428	msload.exe	161
PID 2220 wrote to memory of 5292	2220	NET.exe	217
PID 4192 wrote to memory of 5300	4192	NET.exe	168
PID 3768 wrote to memory of 5308	3768	NET.exe	169
PID 4568 wrote to memory of 5324	4568	NET.exe	171
PID 1360 wrote to memory of 5332	1360	NET.exe	309
PID 5316 wrote to memory of 5352	5316	winsrv.exe	173
PID 5316 wrote to memory of 5360	5316	winsrv.exe	174
PID 5316 wrote to memory of 5368	5316	winsrv.exe	175
PID 5316 wrote to memory of 5376	5316	winsrv.exe	176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,13813501650438695291,12881110621661568458,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,10758093984141760501,478523318137348919,262144 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,12203243768476324729,9490092828794456664,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,3740515115173483897,9480316912990130146,2097152 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7496508927172073190,1252999941101690329,2097152 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,16167764693050922918,8719021985920536621,2097152 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,16374486416659534302,10145105392521209405,2097152 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3985946068927584563,1686829112100211123,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,8826501162122107055,4412885986028910771,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,6052522531842641121,4686649551619190225,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,6052522531842641121,4686649551619190225,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,4640521024451008786,929978379846583966,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6244,i,14322070745207644383,6147180157398560492,2097152 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,3360155771527923489,17886950589897272624,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,16040861330486412094,11026706148430403675,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,12156407332254596588,9330955535573061899,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,10136616284176169302,754876766968891545,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,8315173769447825695,17602396380409125444,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,7763806773616120718,4366060177993417935,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=1224 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,16518063107378969201,1228830136835493999,262144 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,702315001643290303,14326963728923488616,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:8104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,6256906126371444937,9580579461322873170,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,18237462557384440370,3155471496172675885,524288 --field-trial-handle=2928,i,9295568873230130660,1210257198630786619,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1672

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\DanaBot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.exe@4660
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll,f0
    3⤵
    - Family: Chimera
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    PID:4228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 2817852
      4⤵
      Program crash
      PID:4716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 488
  2⤵
  - Program crash
  PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4660 -ip 4660
1⤵
PID:1700

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Net-Worm\Loveware.txt
1⤵
PID:2404

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Net-Worm\Opaserv.l.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Net-Worm\Opaserv.l.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:1504
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3492
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:1900
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:1668
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:2968
- C:\WINDOWS\system\msload.exe
  C:\WINDOWS\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5292
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5324
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:5332
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5300
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:6120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:7560
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:5712
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:7684
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:5700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:7636
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:5796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7676
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:6000
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:7604
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:5760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:2076
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:4272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:1420
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:7688
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:8020
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:7076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7944
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:5728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5900
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:7384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      System Location Discovery: System Language Discovery
      PID:6416
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:2320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:6600
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:5788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:6344
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:1468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:6684
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:7328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      System Location Discovery: System Language Discovery
      PID:2352
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:8056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:6872
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:6532
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      System Location Discovery: System Language Discovery
      PID:4712
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:5200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:3760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:7888
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:4900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:6584
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:916
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:6988
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5936
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:7016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:7028
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:6928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:7784
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:2480
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:2956
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:1644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:4092
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:7632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:5720
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:6072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:8124
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:7856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:1712
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:5804
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:7580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:8000
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:6980
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7468
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7720
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      System Location Discovery: System Language Discovery
      PID:7456
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:2896
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:7100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:7284
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6452
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:3880
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:4476
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7064
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:6384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:1384
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:3904
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:6768
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:1996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:6392
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:1444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:8004
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:6808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7320
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:1504
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:7268
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:5136
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5688
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:7676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:7336
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:4060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:5420
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:1704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:7320
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:5512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5964
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:836
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      System Location Discovery: System Language Discovery
      PID:7336
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:7440
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:6840
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:7024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:6684
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5456
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:6932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:2056
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3424
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:1800
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:5128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:7548
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:8072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7704
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:3480
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      System Location Discovery: System Language Discovery
      PID:6444

\??\c:\windows\system\winsrv.exe
c:\windows\system\winsrv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:5800
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:5360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:5368
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:5976
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:5376
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5984
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:5384
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:5904
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:8180
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:7260
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5492
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:2704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:7580
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:2264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      System Location Discovery: System Language Discovery
      PID:6248
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:1124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7584
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:3060
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:5420
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:8156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:6100
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:6412
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:8032
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:6200
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:5956
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:6328

C:\WINDOWS\BITSPROXY.EXE
C:\WINDOWS\BITSPROXY.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5572
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:5600
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:5436
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:5608
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:5392
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:5668
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:5624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:5588
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5632
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:5652
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:7772
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:7812
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      System Location Discovery: System Language Discovery
      PID:7096
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:7836
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:1420
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:7844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:6896
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:7852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7496
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      System Location Discovery: System Language Discovery
      PID:6932
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:5852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:4672
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:5644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:6728
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:7916
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      System Location Discovery: System Language Discovery
      PID:3408
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:8008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:6248
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:7948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:7480

C:\WINDOWS\MPREXE.EXE
C:\WINDOWS\MPREXE.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5840
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:5860
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:5248
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:5868
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:5528
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:5876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:5292
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:5236
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:5892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:1736
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:6924
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:6960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:7272
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:6968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:7312
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:6976
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:7416
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:6984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:7424
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:6992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      System Location Discovery: System Language Discovery
      PID:7320
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:6996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:7628
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:6972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:5180
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:6432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5168
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:5560
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:5268
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:5584
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5504

C:\WINDOWS\COMP.EXE
C:\WINDOWS\COMP.EXE
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5220
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:4188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:6392
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:5416
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:4832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:7124
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:5176
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:5848
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:5172
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:6356
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:5916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:6632
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:6720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:6008
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:5508
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:6468
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:6820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:6868
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:6404
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:7272

C:\WINDOWS\CRYPTTPMEKSVC.EXE
C:\WINDOWS\CRYPTTPMEKSVC.EXE
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5148
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5400
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:6048
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:5508
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:5404
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:6912
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:5264
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:5364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:5496
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:5768
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:6512
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:5236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6740
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:5588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:6532
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:5196
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:6484
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:6044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6684

C:\WINDOWS\CHAKRA.EXE
C:\WINDOWS\CHAKRA.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1100
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5948
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5744
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:4888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:3492
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:5272
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:7056
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:1736
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:6332
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6276
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:7656
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:6192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:7528
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:3364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:7484
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:5520
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:7504
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:5332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:7616
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:7572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:6300
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:7136
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      System Location Discovery: System Language Discovery
      PID:5524
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:7488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:7184
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:7368
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:8028
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:7612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      System Location Discovery: System Language Discovery
      PID:7132

C:\WINDOWS\DBNMPNTW.EXE
C:\WINDOWS\DBNMPNTW.EXE
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5952
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:6204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:1628
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:6212
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:5924
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:6220
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:5788
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6228
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7080
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:4052
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:6872
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:5248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:7384
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5264
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:2368
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:6816
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:6736
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:6232
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:7316

\??\c:\windows\system\scr.scr
c:\windows\system\scr.scr
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5972
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:6152
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:5448
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:6160
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:6312
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:6168
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:7132
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:6176
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:4100
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:5500
- \??\c:\windows\system\msload.exe
  c:\windows\system\msload.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:6940
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:7020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:7440
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:7036
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:7456
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7044
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:7352
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    PID:7060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      System Location Discovery: System Language Discovery
      PID:7188
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7068
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:7280
- - C:\Windows\SysWOW64\NET.exe
    NET STOP NAVAPSVC
    3⤵
    PID:6436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP NAVAPSVC
      4⤵
      PID:7204
- - C:\Windows\SysWOW64\NET.exe
    NET STOP PERSFW
    3⤵
    PID:7212
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP PERSFW
      4⤵
      PID:4908
- - C:\Windows\SysWOW64\NET.exe
    NET STOP AVPCC
    3⤵
    PID:5976
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AVPCC
      4⤵
      PID:5124
- - C:\Windows\SysWOW64\NET.exe
    NET STOP MCSHIELD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP MCSHIELD
      4⤵
      PID:1900
- - C:\Windows\SysWOW64\NET.exe
    NET STOP SWEEPSRV.SYS
    3⤵
    PID:7048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP SWEEPSRV.SYS
      4⤵
      PID:5132

\??\c:\windows\system\msload.exe
c:\windows\system\msload.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7740
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:7788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2076
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:7796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:7104
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:7804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:5416
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:7820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:5124
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:7828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:5500
- C:\Windows\SysWOW64\NET.exe
  NET STOP NAVAPSVC
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP NAVAPSVC
    3⤵
    PID:6892
- C:\Windows\SysWOW64\NET.exe
  NET STOP PERSFW
  2⤵
  PID:6012
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP PERSFW
    3⤵
    PID:7968
- C:\Windows\SysWOW64\NET.exe
  NET STOP AVPCC
  2⤵
  PID:7108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP AVPCC
    3⤵
    PID:7880
- C:\Windows\SysWOW64\NET.exe
  NET STOP MCSHIELD
  2⤵
  PID:5440
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP MCSHIELD
    3⤵
    PID:1708
- C:\Windows\SysWOW64\NET.exe
  NET STOP SWEEPSRV.SYS
  2⤵
  PID:6368
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP SWEEPSRV.SYS
    3⤵
    PID:8048

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\HawkEye.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\HawkEye.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6768

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Spyware\The Worst Of All!!!!!!\BonziBUDDY!!!!!!.txt
1⤵
PID:8104

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe"
1⤵
PID:6188

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ColorBug.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ColorBug.exe"
1⤵
- Adds Run key to start application
PID:7120

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Time.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Time.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa381d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4228 -ip 4228
1⤵
PID:5604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YOUR_FILES_ARE_ENCRYPTED.HTML

Path C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML
Size 4KB
SHA256 1a65975d9ca89904fc57f87378d0afb3877041b361cd8f3817e039137d59bb3f
MD5 aeabe77dd7b4c9d4d52ebb8f9dd67d24
SHA1 50cab89554c8c7d90a8182118f05781f861d11e7
SHA512 36fe526fa75d0edf02b7538073c46e9d9ee4e4aeb747932ee0caba6068afd3d7578bb63363e1b77b9766a8f130ee54278108a8e5122914451c0d0a2c15cdf335
SSDEEP 96:7lM3TQgwVzlCAQODfNbBeCzS4A84szLdxIcX4X+z/S/iedbKLNJ8wXbe:JM8gSzx3FcPXKNJ8Kbe
TLSH
T192910A779FCA642658A3C517B180FF8DFC0680EB413C1B286E4DC027F2C4135419EB8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d742e9c97e0f08fe852c31accdd4e6d9d573ac0bd8314467d2249a6fed21a46c
MD5 473823eb417fc498fbb889aa6a4b80a0
SHA1 e8c6b3327d5f943c3f5a663fe4d0913c5ec5de06
SHA512 ef4739788f3bc638b72eb5c68dd8fdbad5a89d96748be5c1db466a6c4f552612cdd9fa215f47d1b8f8e830fc464a8db21f14f105de2ef9f1af90b8877a0c12b2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T1E4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 73297cc8ccb166007ba2537196c360d114b1590371d0cb4fc7f435c1c890c292
MD5 3544f6125a18ebd22cad2b8343adcdec
SHA1 09f30b46930068cb1bd4a9b842e53df937d67bb4
SHA512 9576ccdb40b417f5e23c1c573857aba2b24d1c30604efaa8f3fa654d22771e807c5bcf37f8d7a4d28afb56f753902a61cf4fdd27adc8d95c563865ad025df895
TLSH
T17FE026C804ECC26EA624B4C751BC674D82C0374EDBC8AA9A1B0488C9F001969FEC7EF0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fd79000017521d44dc21154fa27b73176526afed41458cf5ed61bb2f44ad05fe
MD5 2a2e777defed1fa6a02482f42f2272c9
SHA1 53e3114a9e5a787f7c4fcc16c260cc6277937c56
SHA512 f46604c348616f4eef1f7b417bb0610a80109b5c5849c8499fd8e9c71413c2a894e309edf0e0d8c922b8486c347235470962f10f929bc3a5fb4bc3888351d88e
SSDEEP 48:GRl2gROZ7JkGNwy1VEiAP1Ckjjt96mfPLhWjkqsfrtPzj4kbtILO2qW994KlQrQg:+2GiCqD1VkCo6YSs5Pzj4gtW4ZQg
TLSH
T1BBC15C0844834951E7D51931F4C2FD96793081E8460FCEF13340967C6D15BE94FA55F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a9e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a9e7.TMP
Size 3KB
SHA256 bb3afe553948f88c946e7dce9dcc8ecf3175d992d6f443ec8085632cc00075d2
MD5 a57dcda37285c7a100ff7a0382c6f6c0
SHA1 fb4e9578ad73cdd64843072df6c4fa813ea7c2c1
SHA512 36630e683e43cf027dda140f9950080330563a08dfcd496c81531f3f233ecc35399d9d9c624234b66ca5f7e139863b4d90aabba79c53c258f554b66aa9ba1990
TLSH
T14271804D09D20492F3E51E31F8D236D7797280BD4A470E7206809BBDAE26F2D4CB52F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 114ef13007b494ba07274e07004e489b4e7fc6ed4c894aab359a3b906ddfaebe
MD5 cb5dda2e620406ad8b6183f7e124d7cd
SHA1 5d94a36aa3b7fe06a98030180cee93fd6b1e6f2b
SHA512 384124b1f2695cd21b368fcd84d9c0173513ae50124fe64499aebafbbe7fb3fd2958dfae26ac8cb95147be01f3c71b4f3ce17e1dbb4fa4d775fdb4c16e149221
TLSH
T1AC4179F787E1956D8A1256F0AA18EE1BCE2C0520831C787989E4BE57D7F3871E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 80677e8a9d495f19fba9d46c6ee55a72394a427bcddd20cac2505bde641a491a
MD5 dc7722b60bd633e8923c627d63191c15
SHA1 0b5c5bb955d7550bbbaf15de6fba780d2c856378
SHA512 16db1b688c8732e9fe4cc46ed3598640dc3720452c26af950121595ba0501941eace045a6b5c3ff2c776e33738fe61ebf4b2702262d2dde95add70154fe69d39
TLSH
T1324179F787E1956D8A1256F0AA18EE2BCE2C0520831C787989E4BE57D7F3871E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 94134d2eb891f450cfb6c1880195d7a8b1b5f18b6f9991d33b7654656861bee1
MD5 ca4a413bd1c5b0e4cbea71f79f0d695a
SHA1 cbda725bf11aa583e9dcada7c8687f0764ed4905
SHA512 5a2d962f6ac7593d8f0a64578eabeb5273294b176e073be995be31edbaa8cc0f91cb7a8e50315d9afc53e21c967fd92488a161a118d4e5a0de829e4e2c80f213
SSDEEP 192:sxZhRZyM/jK1Ml8Mky/fdsPQsxoIdp9wsHW6+WNYYP/YwYuttIgrJ:sxZhTMy/fdsPQsxZ7Hbn/Z9
TLSH
T15D52FA526B38997BCCCBD209F945BB53D6F5456292940E58AAFCDA0C04E6BEC230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3cef928da3eea353b9bd9090714dde01a7153c55dc18307bd694329ec0940f07
MD5 8d857732b96d279eaeef6384f1d88687
SHA1 d81e3a7eb78fc5d7e0572d1d54373beb365910dd
SHA512 ad819352f59d4b314a0c277880bdb390f90efd20b50e41ae7ad151f4def34d8f5cc3e34c8f3054fc7436c361e74966a63d179cca969e06774ecd5300d9251d69
SSDEEP 192:sxZhRZyM/jK1Ml8UQB9y/fdssQJxoIdpvwsHW6+WNYbtXYwzOttIg54J:sxZhTqDy/fdssQJxZVHb6Xwe
TLSH
T1EC620B566A38597BCCCBD209FA51BF53D6F5443291940E58AAFCDA1C00E2BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7b92017dcd3a5172c8fc4de8e3d0dd259210713497870879ce856053b75e06b1
MD5 07116fa94e580be11620da09796dfb04
SHA1 773c6c01c68334d97578008c7db27ce8c142b9b5
SHA512 d33356cb44f2c30e000939d03079073f138a06d46d29fd0333a174a4368e54504f9ccb4df67f54e782924f261637b4feffd3ca090e248a3c5639495515a84fb8
SSDEEP 192:sxZhRZyM/jK1Ml8M9y/fdssQsxoIdp9wsHW6+WNYbtXYwfuttIg5UJ:sxZhT1y/fdssQsxZ7Hb6XgC
TLSH
T1A9521A526B38597BCCCBC209FA45BB53D6F5453292940E58AAFCDA0C04E6BEC231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 35180b69e06d7c7b690984ba1f13e3a3eba54d9db4fdc520f1010e8c4997ed92
MD5 6838d2f4b21bb88a9a24c574b6ed00ea
SHA1 8526b0154e69704f0c948210f77fe48ac224d9d6
SHA512 646a5e27c377ab4a56f23a252edf8a2ce3af139c5005b75e5a2ab16af43ec73918d651410cf3ea81c4ad0ee292b83e312cfbe9514b09798d33112800c85343ec
SSDEEP 192:sxZhRZyM/jK1Ml8UQBjy/fdssQJxoIdpvwsHW6+WNYbtXYwzOttIg54J:sxZhTq1y/fdssQJxZVHb6Xwe
TLSH
T143620A56AA38597BCCCBD209FA51BF53D6F5443291940E58AAFCDA1C00E2BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7adc4b7467cd66d199c24bf5185e6dfe96a49b8ea17e36d877aee1b02fe96954
MD5 b1e4d5617709955dea5593d8dcd362c0
SHA1 fdda6fa7d6520703a4c9c805803f354362a5f96d
SHA512 966c9d2419fea0069ea77cfbdeda43b398f985e041ad38e03195a2e3376e39647b64752b48dcc282bde00799db53ca1d7dad35a5902fdad73f700861ccf58805
SSDEEP 768:2X4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d1rohVcqaZ:2X4jeXmWvmKLEu1jacPLZQdOY7
TLSH
T176D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e85827610906bd855a836917eac8313a03053820d5ed80838bec1bcec57c3d9c
MD5 7209d9698110c6333f12eee9d9f47b18
SHA1 5aa05debdec73e603e250719f51e230b99ca286f
SHA512 d7cc5238eceb7a39b815e6cb7a1584f4b33d22fd1ecb970090925eeb48797538ae0556118a853e972302c60200e5889779d665b5d3ed810a00f9f36061bc2889
SSDEEP 96:KsiUKnKW+1mK+09VU51/3HWt3udn1WKPznTWj9V2jVHoWxkom4M:CTpuVU51/3Hq3u11lznT+9V2jVHoWxk5
TLSH
T16E91855770BF06023D7E2D0C9595DA165A827153305CA43B7BE844E68E6AF6A0DFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5922a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5922a1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2a5f0a133097ae7aeb1c33e8cd5acc4c033ced3cc0cb06452e25d0cec94a3289
MD5 5dc6a5d833686e70d8530fdc48abe523
SHA1 716a1a766053c991edb79c60b3f6e8fb925748e4
SHA512 444800d1033106828dc2474fc807f2e0e83bd39ea1e0a7bdcbd7cddebb37d4a1a4e3c272ff660ccf6c866c570e89549471b7bafe91f250eaa112278e0d4a8716
SSDEEP 384:3ZcIhsN1gxFBgU3lbPf+xOE1hpxJrEFjf5UrzBCUGx:/hvFpRHYOshLhijSNGx
TLSH
T1FC928D71197CAC376EE2E585F88A32578EF44167E2C52BC8D2EC7B2D00DA6AD1707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f99b155113184a2436527922815b6df3e7ba91a6d05aeeb353d7e51f4ecf6136
MD5 30dda1c47f292d00a7180f79d593b2a7
SHA1 a4e9d0363c4597b63b204cbfd9cab35fa4913f79
SHA512 156abe4c04466bc9ac8b17e08b70593bdec125c3c5f33e144e39615b2eb2f3ecd2dcbcd59cd172a034987ffd2bf43845f328f215e6392dd0fb68692b01568248
SSDEEP 192:EONa6hZ0QmiUyyppc/+jVnO1u1m5wOZZ5fvU6:EONa6orpu+xOE1F27fvU6
TLSH
T17202E935687C6C778EE2AE45F48727235FE4212BE9956F84E6E82B1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4716ff071d3958b9fd4c2df00de10479f6aa697e588d5b5d344178306413b801
MD5 26c74a7e77cd40b34bf2a00a3666bc13
SHA1 38bdf08ba1088465b74e8178ebb272b246cab9d3
SHA512 1b31ca23ccafbd20797ff78c7f39fb0b7c718c453dd3bc12fed2613f74b8de67b6f65fb99198601a381345647c294a082a22b46ce5d2cdf435ad3be65ace833e
SSDEEP 384:6ZcIzsN1pxFBgU3lbPf+xOE1hpxJrEFjf5UrzBCUGx:4z6FpRHYOshLhijSNGx
TLSH
T142928E71187CAC3759E2E585F84632579FF48167E2C52BC8D2EC7F2D00DA6AC1707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c59559861a7ba123284aed375ccae2a97bd63e76035e83a613be65d3a4b993e4
MD5 4fde92ad9d7759f8f3425080d0db89a3
SHA1 2ff58b1e6fd2d531a743025cb70ac39145a99ae0
SHA512 7f19be8473ab004f9c86b5779c75d237efc73205abe3cfe84f539661361ed76c0ebeaa8959b0e52925430ec036c3191f9f164d252dfe2329e5df41515e7ce084
SSDEEP 384:NiFsZcIuRsNP8TUNTUlIlpxFBgU3l8Pf+xOE1hpxJrgFjf5UrzBCUGx:EF6ImwgBFp6HYOshLhOjSNGx
TLSH
T1CED23BF208DB9436D9AE9743EB7D2E038EBCC163B5856684B3D86A1CCC9617FD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3463cd0f8b76de7175408e42f6360e1a5c6baa16f9510091c162b2a6a9f73fe4
MD5 e7312519dd223c6a4e9e334e020eef4e
SHA1 dd962e0e89a57b7669d1f5bb8de12539cc403ff4
SHA512 17af0ec953f2521f08d1eb2b531dd41634027678b058009996ccf2cf92c92c12e2381882496be9d9d1cdd279eb351b488fbe4cc585de59206850625338ac49ce
SSDEEP 384:NiFpZcIuisNA8TUNTUlIlpxFBgU328Pf+xOE1hpxJreFjf5UrzBCUGx:EFhjXwgBFpnHYOshLhQjSNGx
TLSH
T107D23BF208DB9436D9AE9743EB7D2E038EBCC163B5846694B3D86A1CCC9617FD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dda15dc34ed989432f0b39807232c28aa6f734e08e2f7f40784e1bd310e19dc0
MD5 fa5f38531ba9706aa0eb1698e35a3ab7
SHA1 5fcc6f78e6fb13c556b64af1b7d954d4690e239d
SHA512 51c42d11df93d5d90a68f573064b617afdafaad83c934fa231b703d0affd159a44666723d5f9f953af8b8e784f4e03e9a8d1911a5901a16ede8eee2624a82100
SSDEEP 192:cONo6hZwQmiUyCGpNc/+jVnO1u1hjFuSJru5cOqlqVUU6:cONo68wNu+xOE1hpxJrB9jU6
TLSH
T17512E731656CAC374DE2A681F48732539EE55267EA897FD4D2EC3B1C00DB66C230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9760a76b-3072-4d7a-9a0e-70ea640cd854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9760a76b-3072-4d7a-9a0e-70ea640cd854.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 483ebfe89476211824ea1e6b74a53a9435ac3566a540aca0406ed45c6626818e
MD5 8ffb0f4679b15c45e8b4345b12c88415
SHA1 ff64b272ca2fd588af4dde5ba7568bb57fb56c71
SHA512 8ee3393404587f41a2cc23172810270a1e07603330756e4cc897bba7fadffac6e0051bedc4a5fbdf4dadd0cb78a0afcc44229f6119a0d67a18bd6cb714d7f97f
TLSH
T15B412A58A6EA1108B3B77F566BF2A5AD447FBC772F07C46D00020D8E0A22B44C961737
MD5 SHA1 SHA512 TLSH

Submit Download

DanaBot.dll

Path C:\Users\Admin\DOWNLO~1\THE-MA~1\THE-MA~1\BANKIN~1\DanaBot.dll
Size 2.4MB
SHA256 abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3
MD5 7e76f7a5c55a5bc5f5e2d7a9e886782b
SHA1 fc500153dba682e53776bef53123086f00c0e041
SHA512 0318e0040f4dbf954f27fb10a69bce2248e785a31d855615a1eaf303a772ad51d47906a113605d7bfd3c2b2265bf83c61538f78b071f85ee3c4948f5cde3fb24
SSDEEP 24576:nqUec48KhhW1bCYo9mvn9YDq+0aM+MqYrtaBwSbx3jMUAlZSVV4VHa4k3NkZED99:nYmFyqi4aeSN3oRlZyAKSo7I3fOic
TLSH
T1BAB55C33B245A5FAC0EB06395927A65899FFBB7165168C1E57F0088C8F365812F3E70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msload.exe

Path C:\Windows\System\msload.exe
Size 12KB
SHA256 c93d4fe28aac9d63003c10585d7db9b32950af33387e45f1cd35d3c5dc128f47
MD5 9a53cd6b36825e500254fca152e1193b
SHA1 d18642e2d45e8886abc6b0fc57f9624e4c7321c5
SHA512 c5de4f00198ab3d27a77ccb9e1ced649dbe1aef6d7f68b94832693825517d032aa8e21ccf95f952e726ef4b8540e7a0402373dec07e4dda2fc6b49db00246328
SSDEEP 192:ns0rjlHb+p8ueAveAdTM3z1zngITYawNLmh1WTNjcNXdi:FjoeAveUT6zXT3ELmhUJcNXd
TLSH
T1EF42B0DF418CF07CF46255B3763891DBB4A137B44E0A6C868A648D4C3A2602B980E49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr.scr

Path C:\Windows\System\scr.scr
Size 28KB
SHA256 de709dacac623c637448dc91f6dfd441a49c89372af2c53e2027e4af5310b95d
MD5 71c981d4f5316c3ad1deefe48fddb94a
SHA1 8e59bbdb29c4234bfcd0465bb6526154bd98b8e4
SHA512 e6ed88ce880e0bbb96995140df0999b1fb3bd45b3d0976e92f94be042d63b8f5030d346f3d24fbadd9822a98690a6d90ba000d9188b3946807fd77735c65c2b1
SSDEEP 768:6AAhTSe5L5gNRy0V3eU8HtsoeohmhwZRGX8:6AAXL5gNRy0ViHtsoe+gX8
TLSH
T1FDD2E0A8612C3944F3A493BF238647F414B459D47BAA03B38CA54648620F67DC5EBD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/428-7220-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-464-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-569-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-523-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-7391-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-1457-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-1341-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-1403-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-1305-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-3847-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/428-500-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1100-495-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1100-511-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1428-7401-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/2852-514-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-1195-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-1401-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-560-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-450-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-2833-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-1340-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-6973-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-498-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2852-1442-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4228-1314-0x0000000000400000-0x000000000066B000-memory.dmp

Download

memory/4228-1342-0x0000000000400000-0x000000000066B000-memory.dmp

Download

memory/4228-530-0x0000000000400000-0x000000000066B000-memory.dmp

Download

memory/4228-579-0x0000000000400000-0x000000000066B000-memory.dmp

Download

memory/4228-437-0x0000000000400000-0x000000000066B000-memory.dmp

Download

memory/4228-570-0x0000000003320000-0x000000000333A000-memory.dmp

Download

memory/4228-475-0x0000000000400000-0x000000000066B000-memory.dmp

Download

memory/4228-7402-0x0000000000400000-0x000000000066B000-memory.dmp

Download

memory/4228-567-0x0000000003320000-0x000000000333A000-memory.dmp

Download

memory/4228-565-0x00000000031C0000-0x00000000031D6000-memory.dmp

Download

memory/4660-436-0x0000000000400000-0x0000000000AAD000-memory.dmp

Download

memory/4700-433-0x0000000002140000-0x00000000023AB000-memory.dmp

Download

memory/5148-494-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5148-533-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5220-535-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5220-485-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5220-515-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5316-469-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5316-526-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5316-509-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5572-472-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5572-512-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5572-521-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5840-476-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5840-505-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5952-537-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5952-518-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5952-497-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5972-496-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5972-506-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/6332-547-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6332-510-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6332-553-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6768-561-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/6924-531-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6924-549-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6940-546-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6940-502-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6940-551-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/7120-1402-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7740-516-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/7740-555-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/7772-519-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/7772-557-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/8180-524-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/8180-559-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads