amadey | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	stub.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	build2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	regasm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	request.exe

Executes dropped EXE 46 IoCs

pid	Process
2796	s.exe
216	handicap.exe
4548	a.exe
4032	b.exe
4664	stub.exe
2744	svchost.exe
2672	build2.exe
3816	Hkbsse.exe
3408	Hkbsse.exe
1112	l2.exe
4908	keylogger.exe
2656	networks_profile.exe
4420	backdoor.exe
848	networks_profile.exe
2900	wahost.exe
3636	regasm.exe
2888	cookie250.exe
512	sahost.exe
2160	out_test_sig.exe
436	TTF.exe
1560	T9.exe
1112	c7.exe
556	mservice64.exe
736	T7.exe
2432	nano.exe
2904	request.exe
1200	wahost.exe
756	1111.exe
5384	regasm.exe
5512	msvcservice.exe
2304	Hkbsse.exe
1572	oobeldr.exe
2280	msvcservice.exe
5380	Identifications.exe
2188	pimer_bbbcontents7.exe
5028	pimer_bbbcontents7.exe
2960	authenticator.exe
728	exec.exe
64	U.exe
1184	WE.exe
2116	Hkbsse.exe
5320	msvcservice.exe
5492	66b5d9d3adbaa_defaultr.exe
5896	66af4e35e761b_doz.exe
5816	Hkbsse.exe
6060	msvcservice.exe

Loads dropped DLL 13 IoCs

pid	Process
848	networks_profile.exe
848	networks_profile.exe
848	networks_profile.exe
848	networks_profile.exe
848	networks_profile.exe
848	networks_profile.exe
512	sahost.exe
512	sahost.exe
512	sahost.exe
512	sahost.exe
512	sahost.exe
512	sahost.exe
512	sahost.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	request.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem = "C:\\Program Files (x86)\\UPNP Subsystem\\upnpss.exe"	nano.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nano.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
90	raw.githubusercontent.com
91	raw.githubusercontent.com
256	pastebin.com
257	pastebin.com
467	raw.githubusercontent.com

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
141	checkip.dyndns.org
177	checkip.dyndns.org
191	ip-api.io
193	ip-api.io
512	ipinfo.io
513	ipinfo.io
895	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2672	powercfg.exe
912	powercfg.exe
5380	powercfg.exe
2000	powercfg.exe
5468	powercfg.exe
3076	powercfg.exe
3536	powercfg.exe
4672	powercfg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
512	sahost.exe
1512	wab.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 436 set thread context of 4820	436	TTF.exe	228
PID 1560 set thread context of 2788	1560	T9.exe	230
PID 736 set thread context of 3096	736	T7.exe	234
PID 2900 set thread context of 1200	2900	wahost.exe	236
PID 3636 set thread context of 5384	3636	regasm.exe	244
PID 2188 set thread context of 5028	2188	pimer_bbbcontents7.exe	263
PID 64 set thread context of 5740	64	U.exe	269
PID 1184 set thread context of 2700	1184	WE.exe	273
PID 512 set thread context of 1512	512	sahost.exe	282
PID 5492 set thread context of 1052	5492	66b5d9d3adbaa_defaultr.exe	300
PID 5896 set thread context of 6068	5896	66af4e35e761b_doz.exe	307

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	nano.exe
File opened for modification	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	nano.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Hkbsse.job	build2.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5768	sc.exe
4864	sc.exe
6016	sc.exe
5900	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x003000000002352d-214.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 60 IoCs

pid	pid_target	Process	procid_target
1392	2672	WerFault.exe	148
3252	2672	WerFault.exe	148
2160	2672	WerFault.exe	148
3116	2672	WerFault.exe	148
4500	2672	WerFault.exe	148
1872	2672	WerFault.exe	148
1972	2672	WerFault.exe	148
1220	2672	WerFault.exe	148
1112	2672	WerFault.exe	148
3992	2672	WerFault.exe	148
3636	2672	WerFault.exe	148
4736	2672	WerFault.exe	148
3828	2672	WerFault.exe	148
5084	3816	WerFault.exe	173
3116	3816	WerFault.exe	173
3260	3816	WerFault.exe	173
4192	3816	WerFault.exe	173
2964	3816	WerFault.exe	173
3188	3816	WerFault.exe	173
1172	3816	WerFault.exe	173
4016	3816	WerFault.exe	173
3732	3816	WerFault.exe	173
1400	3816	WerFault.exe	173
5116	3816	WerFault.exe	173
4664	3816	WerFault.exe	173
1864	3408	WerFault.exe	202
5604	2304	WerFault.exe	251
2256	3816	WerFault.exe	173
1576	3816	WerFault.exe	173
4404	3816	WerFault.exe	173
5352	3816	WerFault.exe	173
3592	5028	WerFault.exe	263
5984	2116	WerFault.exe	285
1576	3816	WerFault.exe	173
2908	3816	WerFault.exe	173
6112	3816	WerFault.exe	173
2420	5816	WerFault.exe	309
1392	3464	WerFault.exe	336
5896	64	WerFault.exe	319
4108	1184	WerFault.exe	386
888	1716	WerFault.exe	404
368	3816	WerFault.exe	173
5932	912	WerFault.exe	407
3400	3816	WerFault.exe	173
5308	3816	WerFault.exe	173
4676	3816	WerFault.exe	173
5172	3816	WerFault.exe	173
3308	3064	WerFault.exe	460
5812	3156	WerFault.exe	470
3768	4220	WerFault.exe	485
3032	2228	WerFault.exe	498
5404	3816	WerFault.exe	173
5288	1740	WerFault.exe	506
984	3816	WerFault.exe	173
1236	5684	WerFault.exe	530
3536	5936	WerFault.exe	549
4136	5936	WerFault.exe	549
668	448	WerFault.exe	573
4284	2168	WerFault.exe	577
3512	6048	WerFault.exe	599

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pimer_bbbcontents7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pimer_bbbcontents7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	out_test_sig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvcservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backdoor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	authenticator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b5d9d3adbaa_defaultr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oobeldr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66af4e35e761b_doz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mservice64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TTF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	request.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keylogger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nano.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvcservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvcservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T9.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4108	netsh.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pimer_bbbcontents7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pimer_bbbcontents7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1111.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
400	timeout.exe
4740	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
1136	systeminfo.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	cookie250.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	cookie250.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5784	schtasks.exe
6068	schtasks.exe
5036	schtasks.exe
3184	schtasks.exe
3076	schtasks.exe
4480	schtasks.exe
3116	schtasks.exe
2720	schtasks.exe
5800	schtasks.exe
1804	schtasks.exe
3184	schtasks.exe
3988	schtasks.exe
3552	schtasks.exe
1020	schtasks.exe
2672	schtasks.exe
1512	schtasks.exe
1988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
4592	msedge.exe
4592	msedge.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
4664	stub.exe
1560	T9.exe
1560	T9.exe
2900	wahost.exe
2900	wahost.exe
3636	regasm.exe
3636	regasm.exe
2900	wahost.exe
1200	wahost.exe
1200	wahost.exe
3636	regasm.exe
3636	regasm.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
3636	regasm.exe
2340	powershell.exe
2340	powershell.exe
3636	regasm.exe
5384	regasm.exe
5384	regasm.exe
1200	wahost.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2340	powershell.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe
2432	nano.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	nano.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
512	sahost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	New Text Document mod.exe
Token: SeDebugPrivilege	4664	stub.exe
Token: SeDebugPrivilege	2744	svchost.exe
Token: SeDebugPrivilege	2744	svchost.exe
Token: SeDebugPrivilege	436	TTF.exe
Token: SeDebugPrivilege	1560	T9.exe
Token: SeDebugPrivilege	736	T7.exe
Token: SeDebugPrivilege	556	mservice64.exe
Token: SeDebugPrivilege	2900	wahost.exe
Token: SeDebugPrivilege	3636	regasm.exe
Token: SeBackupPrivilege	556	mservice64.exe
Token: SeSecurityPrivilege	556	mservice64.exe
Token: SeSecurityPrivilege	556	mservice64.exe
Token: SeSecurityPrivilege	556	mservice64.exe
Token: SeSecurityPrivilege	556	mservice64.exe
Token: SeDebugPrivilege	4820	RegAsm.exe
Token: SeDebugPrivilege	1200	wahost.exe
Token: SeBackupPrivilege	4820	RegAsm.exe
Token: SeSecurityPrivilege	4820	RegAsm.exe
Token: SeSecurityPrivilege	4820	RegAsm.exe
Token: SeSecurityPrivilege	4820	RegAsm.exe
Token: SeSecurityPrivilege	4820	RegAsm.exe
Token: SeDebugPrivilege	2788	RegAsm.exe
Token: SeBackupPrivilege	2788	RegAsm.exe
Token: SeSecurityPrivilege	2788	RegAsm.exe
Token: SeSecurityPrivilege	2788	RegAsm.exe
Token: SeSecurityPrivilege	2788	RegAsm.exe
Token: SeSecurityPrivilege	2788	RegAsm.exe
Token: SeDebugPrivilege	2432	nano.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	5384	regasm.exe
Token: SeDebugPrivilege	2888	cookie250.exe
Token: SeDebugPrivilege	2960	authenticator.exe
Token: SeDebugPrivilege	64	U.exe
Token: SeDebugPrivilege	1184	WE.exe
Token: SeDebugPrivilege	5492	66b5d9d3adbaa_defaultr.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	5896	66af4e35e761b_doz.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
2672	build2.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2796	3128	New Text Document mod.exe	116
PID 3128 wrote to memory of 2796	3128	New Text Document mod.exe	116
PID 3128 wrote to memory of 216	3128	New Text Document mod.exe	122
PID 3128 wrote to memory of 216	3128	New Text Document mod.exe	122
PID 3128 wrote to memory of 4548	3128	New Text Document mod.exe	123
PID 3128 wrote to memory of 4548	3128	New Text Document mod.exe	123
PID 3128 wrote to memory of 4032	3128	New Text Document mod.exe	125
PID 3128 wrote to memory of 4032	3128	New Text Document mod.exe	125
PID 3128 wrote to memory of 4592	3128	New Text Document mod.exe	127
PID 3128 wrote to memory of 4592	3128	New Text Document mod.exe	127
PID 4592 wrote to memory of 3208	4592	msedge.exe	128
PID 4592 wrote to memory of 3208	4592	msedge.exe	128
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2668	4592	msedge.exe	129
PID 4592 wrote to memory of 2180	4592	msedge.exe	130
PID 4592 wrote to memory of 2180	4592	msedge.exe	130
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131
PID 4592 wrote to memory of 3624	4592	msedge.exe	131

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloaders.zip
1⤵
PID:452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3688

C:\Users\Admin\Desktop\New Text Document mod.exe
"C:\Users\Admin\Desktop\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\Desktop\a\s.exe
  "C:\Users\Admin\Desktop\a\s.exe"
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Users\Admin\Desktop\a\handicap.exe
  "C:\Users\Admin\Desktop\a\handicap.exe"
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Users\Admin\Desktop\a\a.exe
  "C:\Users\Admin\Desktop\a\a.exe"
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Users\Admin\Desktop\a\b.exe
  "C:\Users\Admin\Desktop\a\b.exe"
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa7f9646f8,0x7ffa7f964708,0x7ffa7f964718
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,17434483011069758919,11913560610019125889,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,17434483011069758919,11913560610019125889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,17434483011069758919,11913560610019125889,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17434483011069758919,11913560610019125889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17434483011069758919,11913560610019125889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17434483011069758919,11913560610019125889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17434483011069758919,11913560610019125889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
    3⤵
    PID:3960
- C:\Users\Admin\Desktop\a\stub.exe
  "C:\Users\Admin\Desktop\a\stub.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3416
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2DB8.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:400
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2744
- C:\Users\Admin\Desktop\a\build2.exe
  "C:\Users\Admin\Desktop\a\build2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 756
    3⤵
    - Program crash
    PID:1392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 800
    3⤵
    - Program crash
    PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 872
    3⤵
    - Program crash
    PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 904
    3⤵
    - Program crash
    PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 920
    3⤵
    - Program crash
    PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 872
    3⤵
    - Program crash
    PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1044
    3⤵
    - Program crash
    PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1080
    3⤵
    - Program crash
    PID:1220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1152
    3⤵
    - Program crash
    PID:1112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1452
    3⤵
    - Program crash
    PID:3992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1520
    3⤵
    - Program crash
    PID:3636
- - C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
    "C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 556
      4⤵
      Program crash
      PID:5084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 596
      4⤵
      Program crash
      PID:3116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 604
      4⤵
      Program crash
      PID:3260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 716
      4⤵
      Program crash
      PID:4192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 880
      4⤵
      Program crash
      PID:2964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 760
      4⤵
      Program crash
      PID:3188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 880
      4⤵
      Program crash
      PID:1172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 880
      4⤵
      Program crash
      PID:4016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 936
      4⤵
      Program crash
      PID:3732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1012
      4⤵
      Program crash
      PID:1400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1020
      4⤵
      Program crash
      PID:5116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1312
      4⤵
      Program crash
      PID:4664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1144
      4⤵
      Program crash
      PID:2256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1264
      4⤵
      Program crash
      PID:1576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1340
      4⤵
      Program crash
      PID:4404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 884
      4⤵
      Program crash
      PID:5352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 884
      4⤵
      Program crash
      PID:1576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 884
      4⤵
      Program crash
      PID:2908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1020
      4⤵
      Program crash
      PID:6112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1084
      4⤵
      Program crash
      PID:368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 912
      4⤵
      Program crash
      PID:3400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 912
      4⤵
      Program crash
      PID:5308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1340
      4⤵
      Program crash
      PID:4676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1284
      4⤵
      Program crash
      PID:5172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1156
      4⤵
      Program crash
      PID:5404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 908
      4⤵
      Program crash
      PID:984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 828
    3⤵
    - Program crash
    PID:4736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 1276
    3⤵
    - Program crash
    PID:3828
- C:\Users\Admin\Desktop\a\l2.exe
  "C:\Users\Admin\Desktop\a\l2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1112
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1804
- C:\Users\Admin\Desktop\a\keylogger.exe
  "C:\Users\Admin\Desktop\a\keylogger.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Users\Admin\Desktop\a\networks_profile.exe
  "C:\Users\Admin\Desktop\a\networks_profile.exe"
  2⤵
  - Executes dropped EXE
  PID:2656
- - C:\Users\Admin\Desktop\a\networks_profile.exe
    "C:\Users\Admin\Desktop\a\networks_profile.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3896
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4108
- C:\Users\Admin\Desktop\a\backdoor.exe
  "C:\Users\Admin\Desktop\a\backdoor.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420
- C:\Users\Admin\Desktop\a\wahost.exe
  "C:\Users\Admin\Desktop\a\wahost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- - C:\Users\Admin\Desktop\a\wahost.exe
    "C:\Users\Admin\Desktop\a\wahost.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- C:\Users\Admin\Desktop\a\regasm.exe
  "C:\Users\Admin\Desktop\a\regasm.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eVoVlc.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVoVlc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8171.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3184
- - C:\Users\Admin\Desktop\a\regasm.exe
    "C:\Users\Admin\Desktop\a\regasm.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:5384
- C:\Users\Admin\Desktop\a\cookie250.exe
  "C:\Users\Admin\Desktop\a\cookie250.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Users\Admin\Desktop\a\sahost.exe
  "C:\Users\Admin\Desktop\a\sahost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:512
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Users\Admin\Desktop\a\sahost.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:1512
- C:\Users\Admin\Desktop\a\out_test_sig.exe
  "C:\Users\Admin\Desktop\a\out_test_sig.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:1136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-CimInstance -Class Win32_ComputerSystem
    3⤵
    PID:6108
- C:\Users\Admin\Desktop\a\TTF.exe
  "C:\Users\Admin\Desktop\a\TTF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- C:\Users\Admin\Desktop\a\T9.exe
  "C:\Users\Admin\Desktop\a\T9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    PID:3076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\Users\Admin\Desktop\a\c7.exe
  "C:\Users\Admin\Desktop\a\c7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1112
- C:\Users\Admin\Desktop\a\mservice64.exe
  "C:\Users\Admin\Desktop\a\mservice64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Users\Admin\Desktop\a\T7.exe
  "C:\Users\Admin\Desktop\a\T7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
- C:\Users\Admin\Desktop\a\nano.exe
  "C:\Users\Admin\Desktop\a\nano.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Users\Admin\Desktop\a\request.exe
  "C:\Users\Admin\Desktop\a\request.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2904
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1512
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3076
- - C:\Users\Admin\msvcservice.exe
    "C:\Users\Admin\msvcservice.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5512
  - - C:\Windows\SysWOW64\schtasks.exe
      C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5784
- C:\Users\Admin\Desktop\a\1111.exe
  "C:\Users\Admin\Desktop\a\1111.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:756
- C:\Users\Admin\Desktop\a\Identifications.exe
  "C:\Users\Admin\Desktop\a\Identifications.exe"
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe
  "C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2188
- - C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe
    "C:\Users\Admin\Desktop\a\pimer_bbbcontents7.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:5028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1300
      4⤵
      Program crash
      PID:3592
- C:\Users\Admin\Desktop\a\authenticator.exe
  "C:\Users\Admin\Desktop\a\authenticator.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Users\Admin\Desktop\a\exec.exe
  "C:\Users\Admin\Desktop\a\exec.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:728
- C:\Users\Admin\Desktop\a\U.exe
  "C:\Users\Admin\Desktop\a\U.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:64
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5740
- C:\Users\Admin\Desktop\a\WE.exe
  "C:\Users\Admin\Desktop\a\WE.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1232
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2528
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
- C:\Users\Admin\Desktop\a\66b5d9d3adbaa_defaultr.exe
  "C:\Users\Admin\Desktop\a\66b5d9d3adbaa_defaultr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5492
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:1052
  - - C:\ProgramData\GDBAKEGIDB.exe
      "C:\ProgramData\GDBAKEGIDB.exe"
      4⤵
      PID:3260
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:64
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 2116
        6⤵
        Program crash
        
        PID:5896
  - - C:\ProgramData\HDBKFHIJKJ.exe
      "C:\ProgramData\HDBKFHIJKJ.exe"
      4⤵
      PID:2716
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1876
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KFCFBAAEHCFH" & exit
      4⤵
      PID:3908
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4740
- C:\Users\Admin\Desktop\a\66af4e35e761b_doz.exe
  "C:\Users\Admin\Desktop\a\66af4e35e761b_doz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6068
- C:\Users\Admin\Desktop\a\66b5b75106ac6_stealc.exe
  "C:\Users\Admin\Desktop\a\66b5b75106ac6_stealc.exe"
  2⤵
  PID:5312
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3164
- C:\Users\Admin\Desktop\a\66b0ee142cf8f_PhotosExifEditor.exe
  "C:\Users\Admin\Desktop\a\66b0ee142cf8f_PhotosExifEditor.exe"
  2⤵
  PID:1276
- C:\Users\Admin\Desktop\a\66b331646d2cd_123p.exe
  "C:\Users\Admin\Desktop\a\66b331646d2cd_123p.exe"
  2⤵
  PID:1560
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:5468
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:2000
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:5380
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:912
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "VIFLJRPW"
    3⤵
    - Launches sc.exe
    PID:5768
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "VIFLJRPW" binpath= "C:\ProgramData\xprfjygruytr\etzpikspwykg.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4864
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5900
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "VIFLJRPW"
    3⤵
    - Launches sc.exe
    PID:6016
- C:\Users\Admin\Desktop\a\66b837290469c_vidar.exe
  "C:\Users\Admin\Desktop\a\66b837290469c_vidar.exe"
  2⤵
  PID:3464
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1172
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1116
    3⤵
    - Program crash
    PID:1392
- C:\Users\Admin\Desktop\a\66b4af430a0a1_files.exe
  "C:\Users\Admin\Desktop\a\66b4af430a0a1_files.exe"
  2⤵
  PID:6032
- C:\Users\Admin\Desktop\a\66b85f47d1f63_stealc.exe
  "C:\Users\Admin\Desktop\a\66b85f47d1f63_stealc.exe"
  2⤵
  PID:4076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2872
- C:\Users\Admin\Desktop\a\66b74da9b163e_1234.exe
  "C:\Users\Admin\Desktop\a\66b74da9b163e_1234.exe"
  2⤵
  PID:3532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4044
- C:\Users\Admin\Desktop\a\66b5ace3a06b0_dozkey.exe
  "C:\Users\Admin\Desktop\a\66b5ace3a06b0_dozkey.exe"
  2⤵
  PID:5344
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 2088
      4⤵
      Program crash
      PID:4108
- C:\Users\Admin\Desktop\a\66b331997e05e_main21.exe
  "C:\Users\Admin\Desktop\a\66b331997e05e_main21.exe"
  2⤵
  PID:5620
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2212
- C:\Users\Admin\Desktop\a\66b5ac957cc65_crypta.exe
  "C:\Users\Admin\Desktop\a\66b5ac957cc65_crypta.exe"
  2⤵
  PID:3288
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5544
- C:\Users\Admin\Desktop\a\66b7a2aef1283_doz.exe
  "C:\Users\Admin\Desktop\a\66b7a2aef1283_doz.exe"
  2⤵
  PID:4412
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 2160
      4⤵
      Program crash
      PID:888
- C:\Users\Admin\Desktop\a\66b7d3a2e7a4d_deepweb.exe
  "C:\Users\Admin\Desktop\a\66b7d3a2e7a4d_deepweb.exe"
  2⤵
  PID:1424
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4376
- C:\Users\Admin\Desktop\a\ApertureLab.exe
  "C:\Users\Admin\Desktop\a\ApertureLab.exe"
  2⤵
  PID:2712
- - C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe
    "C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe"
    3⤵
    PID:5612
- C:\Users\Admin\Desktop\a\InstallerPack_20.1.23770_win64.exe
  "C:\Users\Admin\Desktop\a\InstallerPack_20.1.23770_win64.exe"
  2⤵
  PID:912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 1996
    3⤵
    - Program crash
    PID:5932
- C:\Users\Admin\Desktop\a\66b7d12b3a8ea_5k.exe
  "C:\Users\Admin\Desktop\a\66b7d12b3a8ea_5k.exe"
  2⤵
  PID:5280
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3536
  - - C:\Users\Admin\AppData\Roaming\TMdDwX6OnZ.exe
      "C:\Users\Admin\AppData\Roaming\TMdDwX6OnZ.exe"
      4⤵
      PID:1052
  - - C:\Users\Admin\AppData\Roaming\nBk8AEQ1KG.exe
      "C:\Users\Admin\AppData\Roaming\nBk8AEQ1KG.exe"
      4⤵
      PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\elton.exe
        
        "C:\Users\Admin\AppData\Local\Temp\elton.exe"
        5⤵
        
        PID:4932
- C:\Users\Admin\Desktop\a\66b7a4a075311_AsianAsp.exe
  "C:\Users\Admin\Desktop\a\66b7a4a075311_AsianAsp.exe"
  2⤵
  PID:4448
- C:\Users\Admin\Desktop\a\NJTCFVIV.exe
  "C:\Users\Admin\Desktop\a\NJTCFVIV.exe"
  2⤵
  PID:2712
- C:\Users\Admin\Desktop\a\66af9bdbf0f60_Team.exe
  "C:\Users\Admin\Desktop\a\66af9bdbf0f60_Team.exe"
  2⤵
  PID:5668
- C:\Users\Admin\Desktop\a\66afa0d3934d8_ultfix.exe
  "C:\Users\Admin\Desktop\a\66afa0d3934d8_ultfix.exe"
  2⤵
  PID:4028
- C:\Users\Admin\Desktop\a\66b38609432fa_sosusion.exe
  "C:\Users\Admin\Desktop\a\66b38609432fa_sosusion.exe"
  2⤵
  PID:1184
- - C:\Users\Admin\AppData\Local\Temp\䥃乚C
    "C:\Users\Admin\AppData\Local\Temp\䥃乚C"
    3⤵
    PID:5236
- C:\Users\Admin\Desktop\a\66b38b9ae0da3_palnet_new.exe
  "C:\Users\Admin\Desktop\a\66b38b9ae0da3_palnet_new.exe"
  2⤵
  PID:2508
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4296
- C:\Users\Admin\Desktop\a\66ae9b239854c_crypto.exe
  "C:\Users\Admin\Desktop\a\66ae9b239854c_crypto.exe"
  2⤵
  PID:5656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6084
- C:\Users\Admin\Desktop\a\66b4ed2ceb0d7_stealc.exe
  "C:\Users\Admin\Desktop\a\66b4ed2ceb0d7_stealc.exe"
  2⤵
  PID:2544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1604
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2368
- C:\Users\Admin\Desktop\a\66b382f122c02_stk.exe
  "C:\Users\Admin\Desktop\a\66b382f122c02_stk.exe"
  2⤵
  PID:1056
- C:\Users\Admin\Desktop\a\66b09f01e0030_dozkey.exe
  "C:\Users\Admin\Desktop\a\66b09f01e0030_dozkey.exe"
  2⤵
  PID:3064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 768
    3⤵
    - Program crash
    PID:3308
- C:\Users\Admin\Desktop\a\66b5ac1092454_otraba.exe
  "C:\Users\Admin\Desktop\a\66b5ac1092454_otraba.exe"
  2⤵
  PID:5888
- C:\Users\Admin\Desktop\a\66b1b02a20b5a_cry.exe
  "C:\Users\Admin\Desktop\a\66b1b02a20b5a_cry.exe"
  2⤵
  PID:2660
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5268
- C:\Users\Admin\Desktop\a\66b28454586cd_monogamer.exe
  "C:\Users\Admin\Desktop\a\66b28454586cd_monogamer.exe"
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 868
    3⤵
    - Program crash
    PID:5812
- C:\Users\Admin\Desktop\a\66ae97ac4c30d_crypted.exe
  "C:\Users\Admin\Desktop\a\66ae97ac4c30d_crypted.exe"
  2⤵
  PID:5644
- C:\Users\Admin\Desktop\a\66b211924622f_LummaC2.exe
  "C:\Users\Admin\Desktop\a\66b211924622f_LummaC2.exe"
  2⤵
  PID:6012
- C:\Users\Admin\Desktop\a\66ab1b27ae40b_BotClient.exe
  "C:\Users\Admin\Desktop\a\66ab1b27ae40b_BotClient.exe"
  2⤵
  PID:3116
- C:\Users\Admin\Desktop\a\66b2871b47a8b_uhigdbf.exe
  "C:\Users\Admin\Desktop\a\66b2871b47a8b_uhigdbf.exe"
  2⤵
  PID:2092
- C:\Users\Admin\Desktop\a\66ae1dd27873e_file.exe
  "C:\Users\Admin\Desktop\a\66ae1dd27873e_file.exe"
  2⤵
  PID:5212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1232
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4248
- C:\Users\Admin\Desktop\a\66b286b03f960_hp-scanner.exe
  "C:\Users\Admin\Desktop\a\66b286b03f960_hp-scanner.exe"
  2⤵
  PID:5756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 800
      4⤵
      Program crash
      PID:3768
- C:\Users\Admin\Desktop\a\66b31f0061c9a_doz.exe
  "C:\Users\Admin\Desktop\a\66b31f0061c9a_doz.exe"
  2⤵
  PID:4520
- C:\Users\Admin\Desktop\a\66b62381ef649_crypted.exe
  "C:\Users\Admin\Desktop\a\66b62381ef649_crypted.exe"
  2⤵
  PID:1428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1564
- C:\Users\Admin\Desktop\a\bot.exe
  "C:\Users\Admin\Desktop\a\bot.exe"
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Automated revisioned systems\Neuro Installer 1.33.4\install\4822F9D\Setup.msi" AI_SETUPEXEPATH=C:\Users\Admin\Desktop\a\bot.exe SETUPEXEDIR=C:\Users\Admin\Desktop\a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1723446410 " AI_EUIMSI=""
    3⤵
    PID:4112
- C:\Users\Admin\Desktop\a\amad.exe
  "C:\Users\Admin\Desktop\a\amad.exe"
  2⤵
  PID:2544
- C:\Users\Admin\Desktop\a\380g.exe
  "C:\Users\Admin\Desktop\a\380g.exe"
  2⤵
  PID:3992
- C:\Users\Admin\Desktop\a\Authenticator222.exe
  "C:\Users\Admin\Desktop\a\Authenticator222.exe"
  2⤵
  PID:3900
- C:\Users\Admin\Desktop\a\uhigdbf.exe
  "C:\Users\Admin\Desktop\a\uhigdbf.exe"
  2⤵
  PID:2184
- C:\Users\Admin\Desktop\a\3544436.exe
  "C:\Users\Admin\Desktop\a\3544436.exe"
  2⤵
  PID:5684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 836
    3⤵
    - Program crash
    PID:1236
- C:\Users\Admin\Desktop\a\343dsxs.exe
  "C:\Users\Admin\Desktop\a\343dsxs.exe"
  2⤵
  PID:5640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1176
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2908
- C:\Users\Admin\Desktop\a\cudo.exe
  "C:\Users\Admin\Desktop\a\cudo.exe"
  2⤵
  PID:2304
- C:\Users\Admin\Desktop\a\300.exe
  "C:\Users\Admin\Desktop\a\300.exe"
  2⤵
  PID:2256
- C:\Users\Admin\Desktop\a\yoyf.exe
  "C:\Users\Admin\Desktop\a\yoyf.exe"
  2⤵
  PID:2344
- C:\Users\Admin\Desktop\a\RedSystem.exe
  "C:\Users\Admin\Desktop\a\RedSystem.exe"
  2⤵
  PID:5936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 920
    3⤵
    - Program crash
    PID:3536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 1308
    3⤵
    - Program crash
    PID:4136
- C:\Users\Admin\Desktop\a\Vhpcde.exe
  "C:\Users\Admin\Desktop\a\Vhpcde.exe"
  2⤵
  PID:4084
- C:\Users\Admin\Desktop\a\systems.exe
  "C:\Users\Admin\Desktop\a\systems.exe"
  2⤵
  PID:116
- C:\Users\Admin\Desktop\a\Team.exe
  "C:\Users\Admin\Desktop\a\Team.exe"
  2⤵
  PID:4396
- C:\Users\Admin\Desktop\a\ConsoleApp3.exe
  "C:\Users\Admin\Desktop\a\ConsoleApp3.exe"
  2⤵
  PID:2848
- C:\Users\Admin\Desktop\a\client.exe
  "C:\Users\Admin\Desktop\a\client.exe"
  2⤵
  PID:5016
- C:\Users\Admin\Desktop\a\06082025.exe
  "C:\Users\Admin\Desktop\a\06082025.exe"
  2⤵
  PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1048
    3⤵
    - Program crash
    PID:668
- C:\Users\Admin\Desktop\a\Opdxdyeul.exe
  "C:\Users\Admin\Desktop\a\Opdxdyeul.exe"
  2⤵
  PID:3200
- C:\Users\Admin\Desktop\a\svch0st.exe
  "C:\Users\Admin\Desktop\a\svch0st.exe"
  2⤵
  PID:5896
- C:\Users\Admin\Desktop\a\newalp.exe
  "C:\Users\Admin\Desktop\a\newalp.exe"
  2⤵
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
    "C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe"
    3⤵
    PID:2720
- C:\Users\Admin\Desktop\a\66b74f08ada90_shapr3D.exe
  "C:\Users\Admin\Desktop\a\66b74f08ada90_shapr3D.exe"
  2⤵
  PID:5916
- C:\Users\Admin\Desktop\a\66b72acef0ad2_7ainstall.exe
  "C:\Users\Admin\Desktop\a\66b72acef0ad2_7ainstall.exe"
  2⤵
  PID:3536
- C:\Users\Admin\Desktop\a\freedom.exe
  "C:\Users\Admin\Desktop\a\freedom.exe"
  2⤵
  PID:4612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\a\freedom.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'freedom.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Windows.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4088
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows" /tr "C:\Users\Admin\Windows.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5800
- C:\Users\Admin\Desktop\a\Operation6572.exe
  "C:\Users\Admin\Desktop\a\Operation6572.exe"
  2⤵
  PID:368
- C:\Users\Admin\Desktop\a\66b11f4cc8fbf_MarriageWriters.exe
  "C:\Users\Admin\Desktop\a\66b11f4cc8fbf_MarriageWriters.exe"
  2⤵
  PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Albums Albums.cmd & Albums.cmd & exit
    3⤵
    PID:4088
- C:\Users\Admin\Desktop\a\66b623c3b1dcb_Mowdiewart.exe
  "C:\Users\Admin\Desktop\a\66b623c3b1dcb_Mowdiewart.exe"
  2⤵
  PID:4176
- C:\Users\Admin\Desktop\a\crt.exe
  "C:\Users\Admin\Desktop\a\crt.exe"
  2⤵
  PID:4788
- - C:\Users\Admin\AppData\Local\Temp\is-6MI2M.tmp\crt.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-6MI2M.tmp\crt.tmp" /SL5="$4008C,3132890,54272,C:\Users\Admin\Desktop\a\crt.exe"
    3⤵
    PID:432
- C:\Users\Admin\Desktop\a\66b6233d1594d_output_32.exe
  "C:\Users\Admin\Desktop\a\66b6233d1594d_output_32.exe"
  2⤵
  PID:3156
- C:\Users\Admin\Desktop\a\P.exe
  "C:\Users\Admin\Desktop\a\P.exe"
  2⤵
  PID:2036
- C:\Users\Admin\Desktop\a\WC.exe
  "C:\Users\Admin\Desktop\a\WC.exe"
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 300
    3⤵
    - Program crash
    PID:3512
- C:\Users\Admin\Desktop\a\L.exe
  "C:\Users\Admin\Desktop\a\L.exe"
  2⤵
  PID:3484
- C:\Users\Admin\Desktop\a\files1.exe
  "C:\Users\Admin\Desktop\a\files1.exe"
  2⤵
  PID:3780
- C:\Users\Admin\Desktop\a\CC.exe
  "C:\Users\Admin\Desktop\a\CC.exe"
  2⤵
  PID:4376
- C:\Users\Admin\Desktop\a\rebackup.exe
  "C:\Users\Admin\Desktop\a\rebackup.exe"
  2⤵
  PID:708
- C:\Users\Admin\Desktop\a\66b4f6893d3c3_shapr3D.exe
  "C:\Users\Admin\Desktop\a\66b4f6893d3c3_shapr3D.exe"
  2⤵
  PID:4820
- C:\Users\Admin\Desktop\a\CW.exe
  "C:\Users\Admin\Desktop\a\CW.exe"
  2⤵
  PID:4616
- C:\Users\Admin\Desktop\a\TY.exe
  "C:\Users\Admin\Desktop\a\TY.exe"
  2⤵
  PID:4180
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4268
- C:\Users\Admin\Desktop\a\66b4b10e9ef0b_stealc_default.exe
  "C:\Users\Admin\Desktop\a\66b4b10e9ef0b_stealc_default.exe"
  2⤵
  PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2672 -ip 2672
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2672 -ip 2672
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2672 -ip 2672
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2672 -ip 2672
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2672 -ip 2672
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2672 -ip 2672
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2672 -ip 2672
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2672 -ip 2672
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2672 -ip 2672
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2672 -ip 2672
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2672 -ip 2672
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2672 -ip 2672
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2672 -ip 2672
1⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3816 -ip 3816
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3816 -ip 3816
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3816 -ip 3816
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3816 -ip 3816
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3816 -ip 3816
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3816 -ip 3816
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3816 -ip 3816
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3816 -ip 3816
1⤵
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3816 -ip 3816
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3816 -ip 3816
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3816 -ip 3816
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3816 -ip 3816
1⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 440
  2⤵
  - Program crash
  PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3408 -ip 3408
1⤵
PID:1572

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 440
  2⤵
  - Program crash
  PID:5604

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1988

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2280
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2304 -ip 2304
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3816 -ip 3816
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3816 -ip 3816
1⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3816 -ip 3816
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3816 -ip 3816
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5028 -ip 5028
1⤵
PID:5456

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 448
  2⤵
  - Program crash
  PID:5984

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5320
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2116 -ip 2116
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3816 -ip 3816
1⤵
PID:3132

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 440
  2⤵
  - Program crash
  PID:2420

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Executes dropped EXE
PID:6060
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3816 -ip 3816
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3816 -ip 3816
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5816 -ip 5816
1⤵
PID:432

C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
1⤵
PID:2124
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2672
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:4672
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:3536
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:3076
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5464
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 64 -ip 64
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1184 -ip 1184
1⤵
PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2872 -ip 2872
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1716 -ip 1716
1⤵
PID:1136

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:5324
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3816 -ip 3816
1⤵
PID:2664

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5608

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 912 -ip 912
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3816 -ip 3816
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3816 -ip 3816
1⤵
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3816 -ip 3816
1⤵
PID:264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3816 -ip 3816
1⤵
PID:3632

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:6096
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2720

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:6100

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:3616

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3156 -ip 3156
1⤵
PID:984

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4220 -ip 4220
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2368 -ip 2368
1⤵
PID:4060

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6052

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2472

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:2228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 440
  2⤵
  - Program crash
  PID:3032

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:4888
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2228 -ip 2228
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3816 -ip 3816
1⤵
PID:64

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 440
  2⤵
  - Program crash
  PID:5288

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:6052
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3988

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3980
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 07DACAB3227282DA5460CB2F09E22C5F C
  2⤵
  PID:5900
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8F4FE3CC77CCFEE67FD6BEFEF604AC43
  2⤵
  PID:5076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6124

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1740 -ip 1740
1⤵
PID:5380

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3816 -ip 3816
1⤵
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5684 -ip 5684
1⤵
PID:512

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:2900
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3552

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3816 -ip 3816
1⤵
PID:4780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:3988

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:3940

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:2528

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5936 -ip 5936
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5936 -ip 5936
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 448 -ip 448
1⤵
PID:5040

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 440
  2⤵
  - Program crash
  PID:4284

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:5864
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2168 -ip 2168
1⤵
PID:708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 6048 -ip 6048
1⤵
PID:2492

C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
1⤵
PID:4548

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:5560
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery