86c84e7c9d1b5eaa12190255599ba4ce04bad1f0153b72936c238382211ef733

Analysis

max time kernel
147s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
Size 27.3MB
Sample260825-s6nrnavdrd
SHA256 86c84e7c9d1b5eaa12190255599ba4ce04bad1f0153b72936c238382211ef733
MD5 34ae761a49ccb69bea96924574ec06b0
SHA1 c1f788aaa557d87f0a7dacc6ac49dd7cc2d07be8
SHA512 9c0ea2eab355d195e23e66095d6d6e85bbf1ec6568d636c6b1cea22e6998beff5a3e7157fde338061acb200df2c65eea05159a48529371f3b15c9274b7c420df
SSDEEP 393216:c/zAIhTlCqFTywoCkhfO/zFXGW/F/P9wXiXzThBeC/+pWt0:c/r5XFTXRkdObGXYztVMa0
TLSH
T1EF57BF11EBE600B4F6B3D171C5B69336C63779210A31DE9FB64C4A992F335908A7E326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 13 IoCs

resource	yara_rule
behavioral2/files/0x0004000000000432-8.dat	UPX
behavioral2/memory/3512-11-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/3512-15-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/716-34-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/3752-53-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/5400-69-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/4508-94-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/2316-120-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/4404-142-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/1852-170-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/4548-192-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/4612-219-0x0000000000400000-0x0000000000535000-memory.dmp	UPX
behavioral2/memory/3900-241-0x0000000000400000-0x0000000000535000-memory.dmp	UPX

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4724	netsh.exe
5656	netsh.exe
1932	netsh.exe

Executes dropped EXE 43 IoCs

pid	Process
1540	OInstallLite.exe
3512	MSActBackup.exe
1692	OUninstall.exe
1616	OInstallLite.exe
716	MSActBackup.exe
5848	OUninstall.exe
2640	OInstallLite.exe
3752	MSActBackup.exe
3272	OUninstall.exe
5400	MSActBackup.exe
2620	OUninstall.exe
2200	OInstallLite.exe
1292	OUninstall.exe
4508	MSActBackup.exe
816	OUninstall.exe
5112	OInstallLite.exe
984	OUninstall.exe
2316	MSActBackup.exe
4496	OUninstall.exe
4728	OInstallLite.exe
3100	OInstallLite.exe
5920	OUninstall.exe
4404	MSActBackup.exe
4588	OUninstall.exe
200	OInstallLite.exe
2716	OUninstall.exe
1852	MSActBackup.exe
5020	OUninstall.exe
4796	OInstallLite.exe
4400	OInstallLite.exe
436	OUninstall.exe
4548	MSActBackup.exe
1904	OUninstall.exe
4348	OInstallLite.exe
1472	OUninstall.exe
4612	MSActBackup.exe
1996	OUninstall.exe
4404	OInstallLite.exe
4900	OUninstall.exe
3900	MSActBackup.exe
4636	OInstallLite.exe
3316	OUninstall.exe
4940	OInstallLite.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0004000000000432-8.dat	upx
behavioral2/memory/3512-11-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/3512-15-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/716-34-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/3752-53-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/5400-69-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/4508-94-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/2316-120-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/4404-142-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/1852-170-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/4548-192-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/4612-219-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral2/memory/3900-241-0x0000000000400000-0x0000000000535000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\KMS\bin\KMSSS.exe	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2348	sc.exe
4348	sc.exe
4696	sc.exe
4512	sc.exe
5932	sc.exe
5084	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
988	cmd.exe
1124	cmd.exe
6000	cmd.exe
5152	cmd.exe
1720	cmd.exe
3896	cmd.exe
2996	cmd.exe
4572	cmd.exe
2524	cmd.exe
720	cmd.exe
3528	cmd.exe
4320	cmd.exe
2596	cmd.exe
5728	cmd.exe
3812	cmd.exe
1364	cmd.exe
792	cmd.exe
2572	cmd.exe
1372	cmd.exe
624	cmd.exe
5808	cmd.exe
124	cmd.exe
5188	cmd.exe
1744	cmd.exe
4460	cmd.exe
4280	cmd.exe
4840	cmd.exe
5048	cmd.exe
5536	cmd.exe
2260	cmd.exe
5596	cmd.exe
1468	cmd.exe
2672	cmd.exe
1984	cmd.exe
1552	cmd.exe
5084	cmd.exe
2692	cmd.exe
2104	cmd.exe
2016	cmd.exe
4708	cmd.exe
3244	cmd.exe
3312	cmd.exe
2280	cmd.exe
792	cmd.exe
4276	cmd.exe
4344	cmd.exe
4260	cmd.exe
5132	cmd.exe
5572	cmd.exe
2376	cmd.exe
4220	cmd.exe
6032	cmd.exe
4996	cmd.exe
4648	cmd.exe
5920	cmd.exe
2404	cmd.exe
4372	cmd.exe
5752	cmd.exe
4124	cmd.exe
4456	cmd.exe
1120	cmd.exe
5028	cmd.exe
4876	cmd.exe
4724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	wmic.exe
4364	wmic.exe
4364	wmic.exe
4364	wmic.exe
1856	wmic.exe
1856	wmic.exe
1856	wmic.exe
1856	wmic.exe
4612	wmic.exe
4612	wmic.exe
4612	wmic.exe
4612	wmic.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
4764	WMIC.exe
4764	WMIC.exe
4764	WMIC.exe
4764	WMIC.exe
5536	wmic.exe
5536	wmic.exe
5536	wmic.exe
5536	wmic.exe
5708	wmic.exe
5708	wmic.exe
5708	wmic.exe
5708	wmic.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2148	wmic.exe
2148	wmic.exe
2148	wmic.exe
2148	wmic.exe
2232	wmic.exe
2232	wmic.exe
2232	wmic.exe
2232	wmic.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
4548	WMIC.exe
4548	WMIC.exe
4548	WMIC.exe
4548	WMIC.exe
2716	wmic.exe
2716	wmic.exe
2716	wmic.exe
2716	wmic.exe
4344	wmic.exe
4344	wmic.exe
4344	wmic.exe
4344	wmic.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
4480	wmic.exe
4480	wmic.exe
4480	wmic.exe
4480	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4364	wmic.exe
Token: SeSecurityPrivilege	4364	wmic.exe
Token: SeTakeOwnershipPrivilege	4364	wmic.exe
Token: SeLoadDriverPrivilege	4364	wmic.exe
Token: SeSystemProfilePrivilege	4364	wmic.exe
Token: SeSystemtimePrivilege	4364	wmic.exe
Token: SeProfSingleProcessPrivilege	4364	wmic.exe
Token: SeIncBasePriorityPrivilege	4364	wmic.exe
Token: SeCreatePagefilePrivilege	4364	wmic.exe
Token: SeBackupPrivilege	4364	wmic.exe
Token: SeRestorePrivilege	4364	wmic.exe
Token: SeShutdownPrivilege	4364	wmic.exe
Token: SeDebugPrivilege	4364	wmic.exe
Token: SeSystemEnvironmentPrivilege	4364	wmic.exe
Token: SeRemoteShutdownPrivilege	4364	wmic.exe
Token: SeUndockPrivilege	4364	wmic.exe
Token: SeManageVolumePrivilege	4364	wmic.exe
Token: 33	4364	wmic.exe
Token: 34	4364	wmic.exe
Token: 35	4364	wmic.exe
Token: 36	4364	wmic.exe
Token: SeIncreaseQuotaPrivilege	4364	wmic.exe
Token: SeSecurityPrivilege	4364	wmic.exe
Token: SeTakeOwnershipPrivilege	4364	wmic.exe
Token: SeLoadDriverPrivilege	4364	wmic.exe
Token: SeSystemProfilePrivilege	4364	wmic.exe
Token: SeSystemtimePrivilege	4364	wmic.exe
Token: SeProfSingleProcessPrivilege	4364	wmic.exe
Token: SeIncBasePriorityPrivilege	4364	wmic.exe
Token: SeCreatePagefilePrivilege	4364	wmic.exe
Token: SeBackupPrivilege	4364	wmic.exe
Token: SeRestorePrivilege	4364	wmic.exe
Token: SeShutdownPrivilege	4364	wmic.exe
Token: SeDebugPrivilege	4364	wmic.exe
Token: SeSystemEnvironmentPrivilege	4364	wmic.exe
Token: SeRemoteShutdownPrivilege	4364	wmic.exe
Token: SeUndockPrivilege	4364	wmic.exe
Token: SeManageVolumePrivilege	4364	wmic.exe
Token: 33	4364	wmic.exe
Token: 34	4364	wmic.exe
Token: 35	4364	wmic.exe
Token: 36	4364	wmic.exe
Token: SeIncreaseQuotaPrivilege	1856	wmic.exe
Token: SeSecurityPrivilege	1856	wmic.exe
Token: SeTakeOwnershipPrivilege	1856	wmic.exe
Token: SeLoadDriverPrivilege	1856	wmic.exe
Token: SeSystemProfilePrivilege	1856	wmic.exe
Token: SeSystemtimePrivilege	1856	wmic.exe
Token: SeProfSingleProcessPrivilege	1856	wmic.exe
Token: SeIncBasePriorityPrivilege	1856	wmic.exe
Token: SeCreatePagefilePrivilege	1856	wmic.exe
Token: SeBackupPrivilege	1856	wmic.exe
Token: SeRestorePrivilege	1856	wmic.exe
Token: SeShutdownPrivilege	1856	wmic.exe
Token: SeDebugPrivilege	1856	wmic.exe
Token: SeSystemEnvironmentPrivilege	1856	wmic.exe
Token: SeRemoteShutdownPrivilege	1856	wmic.exe
Token: SeUndockPrivilege	1856	wmic.exe
Token: SeManageVolumePrivilege	1856	wmic.exe
Token: 33	1856	wmic.exe
Token: 34	1856	wmic.exe
Token: 35	1856	wmic.exe
Token: 36	1856	wmic.exe
Token: SeIncreaseQuotaPrivilege	1856	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 988	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	89
PID 2012 wrote to memory of 3436	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	91
PID 2012 wrote to memory of 5760	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	93
PID 2012 wrote to memory of 2348	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	95
PID 2012 wrote to memory of 4348	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	97
PID 2012 wrote to memory of 3984	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	99
PID 2012 wrote to memory of 620	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	101
PID 2012 wrote to memory of 4696	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	103
PID 2012 wrote to memory of 4512	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	105
PID 2012 wrote to memory of 4364	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	107
PID 2012 wrote to memory of 1540	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	110
PID 1540 wrote to memory of 1856	1540	OInstallLite.exe	111
PID 1540 wrote to memory of 4612	1540	OInstallLite.exe	113
PID 2012 wrote to memory of 4280	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	115
PID 2012 wrote to memory of 1364	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	117
PID 1364 wrote to memory of 5932	1364	cmd.exe	119
PID 2012 wrote to memory of 3512	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	120
PID 2012 wrote to memory of 1692	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	121
PID 1692 wrote to memory of 2016	1692	OUninstall.exe	122
PID 2016 wrote to memory of 4764	2016	cmd.exe	124
PID 1692 wrote to memory of 5536	1692	OUninstall.exe	126
PID 1692 wrote to memory of 5708	1692	OUninstall.exe	128
PID 2012 wrote to memory of 3528	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	133
PID 2012 wrote to memory of 5920	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	134
PID 2012 wrote to memory of 1616	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	137
PID 1616 wrote to memory of 2148	1616	OInstallLite.exe	138
PID 1616 wrote to memory of 2232	1616	OInstallLite.exe	140
PID 2012 wrote to memory of 1124	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	142
PID 2012 wrote to memory of 716	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	144
PID 2012 wrote to memory of 5848	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	145
PID 5848 wrote to memory of 2376	5848	OUninstall.exe	146
PID 2376 wrote to memory of 4548	2376	cmd.exe	148
PID 5848 wrote to memory of 2716	5848	OUninstall.exe	149
PID 5848 wrote to memory of 4344	5848	OUninstall.exe	151
PID 2012 wrote to memory of 4876	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	155
PID 2012 wrote to memory of 4840	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	157
PID 2012 wrote to memory of 2640	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	160
PID 2640 wrote to memory of 4480	2640	OInstallLite.exe	161
PID 2640 wrote to memory of 4696	2640	OInstallLite.exe	163
PID 2012 wrote to memory of 124	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	165
PID 2012 wrote to memory of 3752	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	167
PID 2012 wrote to memory of 5188	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	168
PID 2012 wrote to memory of 2404	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	170
PID 5188 wrote to memory of 5084	5188	cmd.exe	172
PID 2012 wrote to memory of 3272	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	173
PID 3272 wrote to memory of 4456	3272	OUninstall.exe	174
PID 4456 wrote to memory of 1416	4456	cmd.exe	176
PID 3272 wrote to memory of 5768	3272	OUninstall.exe	177
PID 3272 wrote to memory of 3420	3272	OUninstall.exe	179
PID 2012 wrote to memory of 4320	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	183
PID 2012 wrote to memory of 5400	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	185
PID 2012 wrote to memory of 2620	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	186
PID 2620 wrote to memory of 5132	2620	OUninstall.exe	187
PID 5132 wrote to memory of 4704	5132	cmd.exe	189
PID 2620 wrote to memory of 2984	2620	OUninstall.exe	190
PID 2620 wrote to memory of 5732	2620	OUninstall.exe	192
PID 2012 wrote to memory of 1744	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	196
PID 2012 wrote to memory of 2200	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	198
PID 2200 wrote to memory of 4916	2200	OInstallLite.exe	199
PID 2200 wrote to memory of 716	2200	OInstallLite.exe	201
PID 2012 wrote to memory of 4708	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	203
PID 2012 wrote to memory of 4724	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	204
PID 2012 wrote to memory of 1292	2012	2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe	207
PID 1292 wrote to memory of 5388	1292	OUninstall.exe	208

C:\Users\Admin\AppData\Local\Temp\2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_34ae761a49ccb69bea96924574ec06b0_amadey_coinminer_cryptbot_darkgate_glassworm_remcos_rhad.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  - Executes a command shell one-liner
  PID:988
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v DisableAntiSpyware
  2⤵
  PID:3436
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
  2⤵
  PID:5760
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:2348
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query WinDefend
  2⤵
  - Launches sc.exe
  PID:4348
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v DisableAntiSpyware
  2⤵
  PID:3984
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
  2⤵
  PID:620
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4696
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query WinDefend
  2⤵
  - Launches sc.exe
  PID:4512
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:List
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=1540) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe stop KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\system32\sc.exe
    sc.exe stop KMSEmulator
    3⤵
    - Launches sc.exe
    PID:5932
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4764
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=1692) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5536
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:3528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:5920
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=1616) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2148
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:716
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4548
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=5848) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2716
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2640) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4480
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:4696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:124
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe delete KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\system32\sc.exe
    sc.exe delete KMSEmulator
    3⤵
    - Launches sc.exe
    PID:5084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:1416
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=3272) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:5768
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:3420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5400
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:4704
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2620) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:2984
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:5732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2200) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:4916
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    PID:5388
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:3056
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=1292) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:3700
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:3520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:792
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:816
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5048
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:6024
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=816) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:4152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  PID:5824
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=5112) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:4912
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:3240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:1984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  PID:5536
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:5728
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:984
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2260
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:2976
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=984) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:3108
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:3896
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4372
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:2040
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4496) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:4524
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:3468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:5596
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:4728
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4728) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:4304
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:5036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:3100
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=3100) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:6024
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:1188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:5752
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:5920
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2996
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:1820
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=5920) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:2688
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:2552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4572
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Executes a command shell one-liner
  PID:1120
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4724
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5028
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:2344
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4588) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:4704
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:5400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  PID:4920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=200) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:4632
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:3668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:2716
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1372
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:2960
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2716) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:1668
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:5592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:1468
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:5020
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2672
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:5688
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=5020) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:3164
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:5152
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:4796
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4796) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:5888
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:5676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4220
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:4400
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4400) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:2516
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:3244
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:436
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1720
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:5672
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=436) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:5624
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
  2⤵
  PID:4776
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
    3⤵
    PID:5648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  PID:3812
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5656
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:1904
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4344
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:2024
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=1904) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:2204
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:5808
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:4348
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4348) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:1700
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:1472
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3312
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:2076
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=1472) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:1484
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:6120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4260
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:1996
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6000
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:1324
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=1996) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:248
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:5084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4404) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:1048
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:3832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:5572
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:4900
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6032
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:3260
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4900) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:5336
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:5948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:720
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3900
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:4636
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4636) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:6092
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:4740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  - Executes dropped EXE
  PID:3316
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    PID:1696
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:1636
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=3316) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:3196
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OUninstall.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:4124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  PID:4940
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=4940) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:5964
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  - Executes a command shell one-liner
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\OUninstall"
  2⤵
  PID:1856
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4996
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OUninstall.exe"
      4⤵
      PID:3984
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=1856) get ParentProcessID /FORMAT:List /FORMAT:List
    3⤵
    PID:1652
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" process where (ProcessId=2012) get ExecutablePath /FORMAT:List /FORMAT:List
    3⤵
    PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

MSActBackUp.ini

Path C:\Users\Admin\AppData\Local\Temp\MSActBackUp.ini
Size 29B
SHA256 9226c1e7270875fbe1a767271aad96e7447086d2b8dbdfb2bac78432e6173629
MD5 d4e5c484aa6662fa1949c2e6d140e38d
SHA1 8fee8d4743d6e43179f12995a11a26a3cc82bd9f
SHA512 e87b2903cf405810f1f77d11b188708c504a0cccd2617d5a27d2567262392534f1c8c50fe29f186cd53748b9046ba9371b2ab0e049afd648a74a6df731e1d159
MD5 SHA1 SHA512

Submit Download

MSActBackUpPath.ini

Path C:\Users\Admin\AppData\Local\Temp\MSActBackUpPath.ini
Size 36B
SHA256 ad9e97b9f2190ba89ce6f4cc70f1c7b4a45d2603dac2c2cd81d0b30dac2c456f
MD5 1c2349d78149035ec324ef221af89a7f
SHA1 7a5fe3bccf80995db71879d39cebbb30e4758417
SHA512 aadc21c0a490f21d1fbc61c7bc1ec5b58671590e8377bbdf69f94d2b2157c4ef3dbdc84ce31cf82cc74e87ca5b8b44a40699248e118895c042c2a324dd9393c1
MD5 SHA1 SHA512

Submit Download

MSActBackup.exe

Path C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
Size 453KB
SHA256 9c6ad0c7cd85ff0d73c3ece7917b698758b48801323f6800022bd01fb42fde4a
MD5 019d71bd3e4ebf5e1b9171ef6859f071
SHA1 21d297f667f5698af15eee601a9a2a7245fd442f
SHA512 a462744df26b2ae601a9bcd5d0522587c667707bb01dcd39f2388f4a7120149c2c4c1440d8ce587fbb82d5cdd45c9d8138600203d20759cabe1aa48da9353a09
SSDEEP 6144:Ob2IHNapCVGwdAR1oXW5FyRXXw3fz0tePO3R5R38CFmcBROKsx6EehDt:E2IHQCVDAaIsaz0ga18CgcBROjsEe5t
TLSH
T152A4E02E4B5BC0C4D470D978DD6A97F227961D6CCB173023A1D2FFB67032961367AA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OInstallLite.exe

Path C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
Size 13.8MB
SHA256 6667d36582621f728204e587ff78649b22471c777ba6b7bfe47ff698e2ccf6a3
MD5 61536840671a5f6ebee021c96c96aa72
SHA1 e892c0ea0ee84b93a1f6539c49a20df452dc5eb8
SHA512 ca221ae98214341ea864ba99ee6e1ee0258931425298ea2ca3c678219ee91605ecfefcd5db8fe28065a24f0f4a3ea1b761a7512f7fda44dc3c51b6247b68193f
SSDEEP 196608:TnzeqFWPCFJybY7+AkZGvkhfO/7QyOU7XGW/F/P9w9xiXGqXCdUjdL:7CqFTywoCkhfO/zFXGW/F/P9wXiXzTh
TLSH
T1A7E69E15EBD200B0F6739271C5AAD33BC6377A214431DEAFF64C8A497F336515A2A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OUninstall.exe

Path C:\Users\Admin\AppData\Local\Temp\OUninstall.exe
Size 3.1MB
SHA256 121bd7bf8887a92b122bdc304f0f653ab1e80fbb2433647b8272128cebcc8d5e
MD5 8ec087c235ce403df3515569825e07ab
SHA1 e01a4549a8b63a17926349e612f775113e877ecb
SHA512 a9c1861c1052137b3ba00b81baf2293d46ff97f34bef442ba577ab1438e5f6f322d5ba2ca0eeef6d7e23727c69d273536b7b961c32729747cf98e0bf238bb5fc
SSDEEP 49152:ybluVvSzbpsvU/Zyw+ccMkItxNs+Ebuen9c:x2uMk0suH
TLSH
T189E5C7106BF90118F1B3EA74D9B64125CA3779665A35CA4E218C0ACE1F77980C9FFB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-34-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1852-170-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2316-120-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3512-15-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3512-11-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3752-53-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/3900-241-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4404-142-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4508-94-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4548-192-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4612-219-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5400-69-0x0000000000400000-0x0000000000535000-memory.dmp

Download