amadey | 4472ae43b8f3acc33dc1c804fa59e4255192efb57199c1ece226c5a9f5493769

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
5308	netsh.exe
4112	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/316-980-0x00000000023C0000-0x0000000002424000-memory.dmp	net_reactor
behavioral2/memory/316-991-0x0000000002490000-0x00000000024F4000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721438792-2341338383-2410509276-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 9 IoCs

pid	Process
3940	bZDPzyOZs3bf5Eo9MQtIDcwl.exe
1420	aQJc2BjIMs87j62fJ5IeuvAs.exe
4012	CpHDNIA236wpVj_OblNixWxO.exe
424	Aatnbbtdf1CmsbGT2bdQK46N.exe
4468	cyxA0gSjr0ZuozYJdIkdNiYN.exe
4568	zLoPamDu4urjb9kakeoZwOfA.exe
5008	qXcq5UesmsN2FVMPcgUo3bnf.exe
4248	xCzgaQB9XarTTaFAosoZ2eVh.exe
604	xCzgaQB9XarTTaFAosoZ2eVh.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3460	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 28 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2168-0-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-1-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-9-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-11-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-12-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-13-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-14-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-15-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-16-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-17-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-18-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-181-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/memory/2168-296-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/files/0x000700000001abcc-332.dat	themida
behavioral2/files/0x000600000001abde-357.dat	themida
behavioral2/files/0x000700000001abcd-528.dat	themida
behavioral2/memory/2168-587-0x00007FF7C2AA0000-0x00007FF7C3491000-memory.dmp	themida
behavioral2/files/0x000600000001abde-873.dat	themida
behavioral2/files/0x000600000001abde-872.dat	themida
behavioral2/memory/3468-935-0x00000000002F0000-0x0000000000FEF000-memory.dmp	themida
behavioral2/memory/2980-927-0x0000000000180000-0x0000000001133000-memory.dmp	themida
behavioral2/files/0x000700000001abcd-911.dat	themida
behavioral2/files/0x000700000001abcd-910.dat	themida
behavioral2/files/0x000700000001abcc-871.dat	themida
behavioral2/memory/3468-946-0x00000000002F0000-0x0000000000FEF000-memory.dmp	themida
behavioral2/memory/2980-952-0x0000000000180000-0x0000000001133000-memory.dmp	themida
behavioral2/memory/2880-969-0x0000000000B40000-0x0000000001454000-memory.dmp	themida
behavioral2/files/0x000700000001abcc-1103.dat	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
124	api.2ip.ua
126	api.2ip.ua
130	api.myip.com
2	api.myip.com
4	api.myip.com
9	ipinfo.io
10	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2168	setup.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3624	sc.exe
5412	sc.exe
5884	sc.exe
2180	sc.exe
3088	sc.exe
1320	sc.exe
6016	sc.exe
4116	sc.exe
5320	sc.exe
3928	sc.exe
5236	sc.exe
5644	sc.exe
5812	sc.exe
3264	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 33 IoCs

pid	pid_target	Process	procid_target
4584	4012	WerFault.exe	78
4480	1420	WerFault.exe	80
5360	1332	WerFault.exe	121
5388	1332	WerFault.exe	121
5648	1332	WerFault.exe	121
5900	5840	WerFault.exe	136
5920	1332	WerFault.exe	121
5704	1332	WerFault.exe	121
216	1332	WerFault.exe	121
5176	1332	WerFault.exe	121
3292	1332	WerFault.exe	121
4604	1332	WerFault.exe	121
5240	1332	WerFault.exe	121
5228	1332	WerFault.exe	121
5316	1332	WerFault.exe	121
2980	1332	WerFault.exe	121
5504	1332	WerFault.exe	121
4504	1332	WerFault.exe	121
5488	1332	WerFault.exe	121
5716	1332	WerFault.exe	121
6096	1332	WerFault.exe	121
5440	1332	WerFault.exe	121
4912	3996	WerFault.exe	194
5992	4264	WerFault.exe	207
788	4264	WerFault.exe	207
5240	4264	WerFault.exe	207
4196	4264	WerFault.exe	207
5356	4264	WerFault.exe	207
4892	4264	WerFault.exe	207
1692	4264	WerFault.exe	207
4384	4264	WerFault.exe	207
4788	4264	WerFault.exe	207
5440	4120	WerFault.exe	231

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bZDPzyOZs3bf5Eo9MQtIDcwl.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bZDPzyOZs3bf5Eo9MQtIDcwl.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bZDPzyOZs3bf5Eo9MQtIDcwl.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2128	schtasks.exe
4444	schtasks.exe
5052	schtasks.exe
6092	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5332	timeout.exe
5624	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
6092	tasklist.exe
2560	tasklist.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	Process not Found

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2168	setup.exe
2168	setup.exe
3940	bZDPzyOZs3bf5Eo9MQtIDcwl.exe
3940	bZDPzyOZs3bf5Eo9MQtIDcwl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
424	Aatnbbtdf1CmsbGT2bdQK46N.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3940	2168	setup.exe	79
PID 2168 wrote to memory of 3940	2168	setup.exe	79
PID 2168 wrote to memory of 3940	2168	setup.exe	79
PID 2168 wrote to memory of 1420	2168	setup.exe	80
PID 2168 wrote to memory of 1420	2168	setup.exe	80
PID 2168 wrote to memory of 1420	2168	setup.exe	80
PID 2168 wrote to memory of 4012	2168	setup.exe	78
PID 2168 wrote to memory of 4012	2168	setup.exe	78
PID 2168 wrote to memory of 4012	2168	setup.exe	78
PID 2168 wrote to memory of 424	2168	setup.exe	77
PID 2168 wrote to memory of 424	2168	setup.exe	77
PID 2168 wrote to memory of 424	2168	setup.exe	77
PID 2168 wrote to memory of 4468	2168	Process not Found	76
PID 2168 wrote to memory of 4468	2168	Process not Found	76
PID 2168 wrote to memory of 4468	2168	Process not Found	76
PID 2168 wrote to memory of 5008	2168	Process not Found	82
PID 2168 wrote to memory of 5008	2168	Process not Found	82
PID 2168 wrote to memory of 5008	2168	Process not Found	82
PID 2168 wrote to memory of 4568	2168	Process not Found	83
PID 2168 wrote to memory of 4568	2168	Process not Found	83
PID 2168 wrote to memory of 4248	2168	Process not Found	84
PID 2168 wrote to memory of 4248	2168	Process not Found	84
PID 2168 wrote to memory of 4248	2168	Process not Found	84
PID 4248 wrote to memory of 604	4248	xCzgaQB9XarTTaFAosoZ2eVh.exe	85
PID 4248 wrote to memory of 604	4248	xCzgaQB9XarTTaFAosoZ2eVh.exe	85
PID 4248 wrote to memory of 604	4248	xCzgaQB9XarTTaFAosoZ2eVh.exe	85

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\Documents\GuardFox\cyxA0gSjr0ZuozYJdIkdNiYN.exe
  "C:\Users\Admin\Documents\GuardFox\cyxA0gSjr0ZuozYJdIkdNiYN.exe"
  2⤵
  - Executes dropped EXE
  PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Documents\GuardFox\cyxA0gSjr0ZuozYJdIkdNiYN.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    PID:6024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5332
- C:\Users\Admin\Documents\GuardFox\Aatnbbtdf1CmsbGT2bdQK46N.exe
  "C:\Users\Admin\Documents\GuardFox\Aatnbbtdf1CmsbGT2bdQK46N.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:424
- C:\Users\Admin\Documents\GuardFox\CpHDNIA236wpVj_OblNixWxO.exe
  "C:\Users\Admin\Documents\GuardFox\CpHDNIA236wpVj_OblNixWxO.exe"
  2⤵
  - Executes dropped EXE
  PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 480
    3⤵
    - Program crash
    PID:4584
- C:\Users\Admin\Documents\GuardFox\bZDPzyOZs3bf5Eo9MQtIDcwl.exe
  "C:\Users\Admin\Documents\GuardFox\bZDPzyOZs3bf5Eo9MQtIDcwl.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Users\Admin\Documents\GuardFox\aQJc2BjIMs87j62fJ5IeuvAs.exe
  "C:\Users\Admin\Documents\GuardFox\aQJc2BjIMs87j62fJ5IeuvAs.exe"
  2⤵
  - Executes dropped EXE
  PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 512
    3⤵
    - Program crash
    PID:4480
- C:\Users\Admin\Documents\GuardFox\qXcq5UesmsN2FVMPcgUo3bnf.exe
  "C:\Users\Admin\Documents\GuardFox\qXcq5UesmsN2FVMPcgUo3bnf.exe"
  2⤵
  - Executes dropped EXE
  PID:5008
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\dpFQW.CPL",
    3⤵
    PID:408
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\dpFQW.CPL",
      4⤵
      PID:1496
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\dpFQW.CPL",
        5⤵
        
        PID:5792
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\dpFQW.CPL",
        6⤵
        
        PID:5808
- C:\Users\Admin\Documents\GuardFox\zLoPamDu4urjb9kakeoZwOfA.exe
  "C:\Users\Admin\Documents\GuardFox\zLoPamDu4urjb9kakeoZwOfA.exe"
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Users\Admin\Documents\GuardFox\xCzgaQB9XarTTaFAosoZ2eVh.exe
  "C:\Users\Admin\Documents\GuardFox\xCzgaQB9XarTTaFAosoZ2eVh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Users\Admin\AppData\Local\Temp\is-V57RV.tmp\xCzgaQB9XarTTaFAosoZ2eVh.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-V57RV.tmp\xCzgaQB9XarTTaFAosoZ2eVh.tmp" /SL5="$600D0,3763271,54272,C:\Users\Admin\Documents\GuardFox\xCzgaQB9XarTTaFAosoZ2eVh.exe"
    3⤵
    - Executes dropped EXE
    PID:604
  - - C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe
      "C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe" -i
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe
      "C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe" -s
      4⤵
      PID:4564
- C:\Users\Admin\Documents\GuardFox\vtassuxNm8k1G37zCNL2Pd5a.exe
  "C:\Users\Admin\Documents\GuardFox\vtassuxNm8k1G37zCNL2Pd5a.exe"
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4444
- C:\Users\Admin\Documents\GuardFox\P1ilh90OjHasobVS26Ix2swI.exe
  "C:\Users\Admin\Documents\GuardFox\P1ilh90OjHasobVS26Ix2swI.exe"
  2⤵
  PID:3272
- - C:\Users\Admin\Documents\GuardFox\P1ilh90OjHasobVS26Ix2swI.exe
    "C:\Users\Admin\Documents\GuardFox\P1ilh90OjHasobVS26Ix2swI.exe"
    3⤵
    PID:4976
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\b962b354-40cf-4707-9755-d4ceab7b2522" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:3460
  - - C:\Users\Admin\Documents\GuardFox\P1ilh90OjHasobVS26Ix2swI.exe
      "C:\Users\Admin\Documents\GuardFox\P1ilh90OjHasobVS26Ix2swI.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:2320
    - - C:\Users\Admin\Documents\GuardFox\P1ilh90OjHasobVS26Ix2swI.exe
        
        "C:\Users\Admin\Documents\GuardFox\P1ilh90OjHasobVS26Ix2swI.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        
        PID:3476
- C:\Users\Admin\Documents\GuardFox\ghQKTZIlsiivVCSn2cjVHq65.exe
  "C:\Users\Admin\Documents\GuardFox\ghQKTZIlsiivVCSn2cjVHq65.exe"
  2⤵
  PID:1256
- C:\Users\Admin\Documents\GuardFox\MKjlh0fjB0bUXSeHuFxTwRJW.exe
  "C:\Users\Admin\Documents\GuardFox\MKjlh0fjB0bUXSeHuFxTwRJW.exe"
  2⤵
  PID:4440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:5944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:5924
- C:\Users\Admin\Documents\GuardFox\kK9iapCSoPFOq17om0AW9XMN.exe
  "C:\Users\Admin\Documents\GuardFox\kK9iapCSoPFOq17om0AW9XMN.exe"
  2⤵
  PID:2188
- - C:\Users\Admin\Documents\GuardFox\qemu-ga.exe
    "C:\Users\Admin\Documents\GuardFox\qemu-ga.exe"
    3⤵
    PID:4400
- C:\Users\Admin\Documents\GuardFox\bPPd6tIcDVVhilDBjU1Srhw_.exe
  "C:\Users\Admin\Documents\GuardFox\bPPd6tIcDVVhilDBjU1Srhw_.exe"
  2⤵
  PID:1304
- - C:\Users\Admin\Documents\GuardFox\tgYQOtVnFx7kt3VYE89gJy_e.exe
    "C:\Users\Admin\Documents\GuardFox\tgYQOtVnFx7kt3VYE89gJy_e.exe"
    3⤵
    PID:3792
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tgYQOtVnFx7kt3VYE89gJy_e.exe /TR "C:\Users\Admin\Documents\GuardFox\tgYQOtVnFx7kt3VYE89gJy_e.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\1000113001\e0cbefcb1af40c7d4aff4aca26621a98.exe
      "C:\Users\Admin\AppData\Local\Temp\1000113001\e0cbefcb1af40c7d4aff4aca26621a98.exe"
      4⤵
      PID:1332
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 388
        5⤵
        Program crash
        
        PID:5360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 404
        5⤵
        Program crash
        
        PID:5388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 352
        5⤵
        Program crash
        
        PID:5648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 624
        5⤵
        Program crash
        
        PID:5920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 660
        5⤵
        Program crash
        
        PID:5704
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 724
        5⤵
        Program crash
        
        PID:216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 716
        5⤵
        Program crash
        
        PID:5176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 660
        5⤵
        Program crash
        
        PID:3292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 860
        5⤵
        Program crash
        
        PID:4604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 896
        5⤵
        Program crash
        
        PID:5240
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 976
        5⤵
        Program crash
        
        PID:5228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1016
        5⤵
        Program crash
        
        PID:5316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 996
        5⤵
        Program crash
        
        PID:2980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 952
        5⤵
        Program crash
        
        PID:5504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 868
        5⤵
        Program crash
        
        PID:4504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 876
        5⤵
        Program crash
        
        PID:5488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 776
        5⤵
        Program crash
        
        PID:5716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 992
        5⤵
        Program crash
        
        PID:6096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 996
        5⤵
        Program crash
        
        PID:5440
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\1000113001\e0cbefcb1af40c7d4aff4aca26621a98.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000113001\e0cbefcb1af40c7d4aff4aca26621a98.exe"
        5⤵
        
        PID:4264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 352
        6⤵
        Program crash
        
        PID:5992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 360
        6⤵
        Program crash
        
        PID:788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 368
        6⤵
        Program crash
        
        PID:5240
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 596
        6⤵
        Program crash
        
        PID:4196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 604
        6⤵
        Program crash
        
        PID:5356
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 668
        6⤵
        Program crash
        
        PID:4892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 556
        6⤵
        Program crash
        
        PID:1692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 680
        6⤵
        Program crash
        
        PID:4384
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 776
        6⤵
        Program crash
        
        PID:4788
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5980
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:6016
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:5308
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:4084
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\1000114001\InstallSetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\1000114001\InstallSetup8.exe"
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        
        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        5⤵
        
        PID:5548
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        6⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        7⤵
        Creates scheduled task(s)
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\nsaAB60.tmp
        
        C:\Users\Admin\AppData\Local\Temp\nsaAB60.tmp
        5⤵
        
        PID:5244
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsaAB60.tmp" & del "C:\ProgramData\*.dll"" & exit
        6⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        7⤵
        Delays execution with timeout.exe
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\1000115001\toolspub1.exe
      "C:\Users\Admin\AppData\Local\Temp\1000115001\toolspub1.exe"
      4⤵
      PID:5840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 488
        5⤵
        Program crash
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\1000117001\rty27.exe
      "C:\Users\Admin\AppData\Local\Temp\1000117001\rty27.exe"
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\1000119001\FirstZ.exe
      "C:\Users\Admin\AppData\Local\Temp\1000119001\FirstZ.exe"
      4⤵
      PID:2872
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        
        PID:4792
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2144
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:4888
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:6016
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5644
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:4116
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:5412
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "WSNKISKT"
        5⤵
        Launches sc.exe
        
        PID:5812
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        
        PID:2144
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        
        PID:5040
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        
        PID:3596
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        
        PID:5660
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:5884
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "WSNKISKT"
        5⤵
        Launches sc.exe
        
        PID:2180
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:3264
- C:\Users\Admin\Documents\GuardFox\Tes3oe7FjncWnROnUTDX72_9.exe
  "C:\Users\Admin\Documents\GuardFox\Tes3oe7FjncWnROnUTDX72_9.exe"
  2⤵
  PID:3468
- C:\Users\Admin\Documents\GuardFox\6m2ogfw_l1xAF15xX60194J3.exe
  "C:\Users\Admin\Documents\GuardFox\6m2ogfw_l1xAF15xX60194J3.exe"
  2⤵
  PID:2980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2384 --field-trial-handle=2604,i,18397370029487075685,539361059131701202,131072 /prefetch:1
      4⤵
      PID:4384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2376 --field-trial-handle=2604,i,18397370029487075685,539361059131701202,131072 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1820 --field-trial-handle=2604,i,18397370029487075685,539361059131701202,131072 /prefetch:8
      4⤵
      PID:600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=2604,i,18397370029487075685,539361059131701202,131072 /prefetch:8
      4⤵
      PID:720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=2604,i,18397370029487075685,539361059131701202,131072 /prefetch:2
      4⤵
      PID:4896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=2604,i,18397370029487075685,539361059131701202,131072 /prefetch:8
      4⤵
      PID:5556
- C:\Users\Admin\Documents\GuardFox\q4ecAlr1tIKNfpr87XU51fw2.exe
  "C:\Users\Admin\Documents\GuardFox\q4ecAlr1tIKNfpr87XU51fw2.exe"
  2⤵
  PID:2880
- C:\Users\Admin\Documents\GuardFox\9J6lFhixlbvBiLXarJXWgnol.exe
  "C:\Users\Admin\Documents\GuardFox\9J6lFhixlbvBiLXarJXWgnol.exe"
  2⤵
  PID:316
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffca0c79758,0x7ffca0c79768,0x7ffca0c79778
        5⤵
        
        PID:4064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:8
        5⤵
        
        PID:784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:8
        5⤵
        
        PID:5216
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2792 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:1
        5⤵
        
        PID:1276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2784 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:1
        5⤵
        
        PID:5192
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:2
        5⤵
        
        PID:6096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4036 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:1
        5⤵
        
        PID:2972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4628 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:8
        5⤵
        
        PID:3788
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:8
        5⤵
        
        PID:1328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:8
        5⤵
        
        PID:6080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1744,i,9627972987035247977,6141836106083721167,131072 /prefetch:8
        5⤵
        
        PID:5684

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4200

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:4968

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:1464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffca0c79758,0x7ffca0c79768,0x7ffca0c79778
1⤵
PID:4988

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5656

C:\Users\Admin\Documents\GuardFox\tgYQOtVnFx7kt3VYE89gJy_e.exe
C:\Users\Admin\Documents\GuardFox\tgYQOtVnFx7kt3VYE89gJy_e.exe
1⤵
PID:5888

C:\Users\Admin\AppData\Local\Temp\B0DC.exe
C:\Users\Admin\AppData\Local\Temp\B0DC.exe
1⤵
PID:3956
- C:\Users\Admin\AppData\Local\Temp\B0DC.exe
  C:\Users\Admin\AppData\Local\Temp\B0DC.exe
  2⤵
  PID:5736

C:\Users\Admin\AppData\Local\Temp\B978.exe
C:\Users\Admin\AppData\Local\Temp\B978.exe
1⤵
PID:660
- C:\Windows\SysWOW64\cmd.exe
  cmd /k cmd < Dot & exit
  2⤵
  PID:4344
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    PID:5704
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6092
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2560
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe"
      4⤵
      PID:1808

C:\Users\Admin\AppData\Local\Temp\C149.exe
C:\Users\Admin\AppData\Local\Temp\C149.exe
1⤵
PID:2984
- C:\Users\Admin\AppData\Local\Temp\is-S0M6A.tmp\C149.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-S0M6A.tmp\C149.tmp" /SL5="$140076,3501695,54272,C:\Users\Admin\AppData\Local\Temp\C149.exe"
  2⤵
  PID:5124

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1496

C:\Users\Admin\AppData\Local\Temp\D484.exe
C:\Users\Admin\AppData\Local\Temp\D484.exe
1⤵
PID:5684
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  PID:5976
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    PID:4196
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4896
  - - C:\Windows\System32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:6052
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3636
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5132
- C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
  2⤵
  PID:5492

C:\Users\Admin\AppData\Local\Temp\E1D4.exe
C:\Users\Admin\AppData\Local\Temp\E1D4.exe
1⤵
PID:3996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 480
  2⤵
  - Program crash
  PID:4912

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\EC73.dll
1⤵
PID:4792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\EC73.dll
  2⤵
  PID:720

C:\Users\Admin\AppData\Local\Temp\F2BE.exe
C:\Users\Admin\AppData\Local\Temp\F2BE.exe
1⤵
PID:2980

C:\Users\Admin\AppData\Local\Temp\8E7.exe
C:\Users\Admin\AppData\Local\Temp\8E7.exe
1⤵
PID:3788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:880

C:\Users\Admin\AppData\Local\Temp\1FAC.exe
C:\Users\Admin\AppData\Local\Temp\1FAC.exe
1⤵
PID:5360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:4512

C:\Users\Admin\AppData\Local\Temp\3B53.exe
C:\Users\Admin\AppData\Local\Temp\3B53.exe
1⤵
PID:3216

C:\Users\Admin\Documents\GuardFox\tgYQOtVnFx7kt3VYE89gJy_e.exe
C:\Users\Admin\Documents\GuardFox\tgYQOtVnFx7kt3VYE89gJy_e.exe
1⤵
PID:5340

C:\Users\Admin\AppData\Roaming\hdsdhcc
C:\Users\Admin\AppData\Roaming\hdsdhcc
1⤵
PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 480
  2⤵
  - Program crash
  PID:5440

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
PID:5944
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:5296
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5712
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2284
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3928
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3088
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1320
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5236
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1388
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:1040
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:748
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:5568
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:5248
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery