87b9bcfe0669495f1c149aafa02ed8ae459834314a6f6c140a0b628c959e29b4

Analysis

max time kernel
1s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.7MB
Sample260903-2k8dlsxdla
SHA256 87b9bcfe0669495f1c149aafa02ed8ae459834314a6f6c140a0b628c959e29b4
MD5 ca7f2629f2258459cacbe7c1d2113d75
SHA1 3c70d22a09944b4cb2f841b9ec9a9a6fb57b13df
SHA512 33cfa46abf3fde7ea65b10fb2354ee6b617dc60cf35641534063c457752c8272365dc7d883ace54e918c20982655a07138ef319cca2d4280c5fd5a8a12336d5a
SSDEEP 49152:JJuUdcOsBiichOqlrfOrJfD0/C1zh/FBHXa+SXMALucbpIlaQ4/X2jM865npKKQh:JJVdnwOCbScq2AhnY7XFHEI
TLSH
T18F664A07ECA515E9C1ADD2358A739512BF717C481B2123D72B90F6283F76BE0AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence ransomware stealer

Malware Config

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
10904	wevtutil.exe
7224	wevtutil.exe
7596	wevtutil.exe
11816	wevtutil.exe
7268	wevtutil.exe
20072	wevtutil.exe
18904	wevtutil.exe
14496	Process not Found
20136	Process not Found
7352	Process not Found
21592	Process not Found
14780	Process not Found
7424	wevtutil.exe
14656	wevtutil.exe
19428	wevtutil.exe
21416	wevtutil.exe
15004	wevtutil.exe
20036	Process not Found
26960	Process not Found
8344	wevtutil.exe
7116	wevtutil.exe
24256	wevtutil.exe
25064	wevtutil.exe
23804	Process not Found
20964	wevtutil.exe
24100	wevtutil.exe
18068	Process not Found
25500	wevtutil.exe
25672	Process not Found
18136	Process not Found
10916	Process not Found
1180	wevtutil.exe
21908	wevtutil.exe
24144	wevtutil.exe
24024	wevtutil.exe
26128	Process not Found
1108	Process not Found
13444	Process not Found
12412	Process not Found
14908	wevtutil.exe
14688	wevtutil.exe
24992	Process not Found
22764	Process not Found
11256	Process not Found
26212	Process not Found
13920	wevtutil.exe
21372	wevtutil.exe
6916	Process not Found
2588	Process not Found
26512	Process not Found
24096	Process not Found
8856	wevtutil.exe
27284	Process not Found
6036	Process not Found
18652	wevtutil.exe
20648	wevtutil.exe
21664	wevtutil.exe
20472	wevtutil.exe
24572	Process not Found
13072	Process not Found
13652	wevtutil.exe
24424	Process not Found
25284	Process not Found
6560	wevtutil.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
9688	Process not Found
9204	Process not Found
11168	powershell.exe
7280	Process not Found
21136	powershell.exe
2556	powershell.exe
25900	Process not Found
7564	powershell.exe
21736	powershell.exe
27088	Process not Found
8888	Process not Found
21344	Process not Found
11728	powershell.exe
20140	powershell.exe
25340	Process not Found
21584	Process not Found
2184	Process not Found
19136	powershell.exe
22996	Process not Found
9860	powershell.exe
17132	powershell.exe
18412	Process not Found
16300	powershell.exe
23408	Process not Found
24572	Process not Found
13348	Process not Found
21676	Process not Found
7052	Process not Found
24484	Process not Found
996	powershell.exe
10224	powershell.exe
12232	powershell.exe
5840	Process not Found
12276	Process not Found
21380	Process not Found
8428	powershell.exe
20872	Process not Found
24596	Process not Found
27256	Process not Found
6472	Process not Found
7592	Process not Found
22376	Process not Found
20980	powershell.exe
8532	powershell.exe
23828	powershell.exe
14416	Process not Found
11176	Process not Found
27600	Process not Found
4024	Process not Found
22436	Process not Found
21300	Process not Found
25988	Process not Found
26428	Process not Found
14996	Process not Found
11396	Process not Found
9260	Process not Found
26952	Process not Found
12876	Process not Found
7644	powershell.exe
13500	powershell.exe
17856	Process not Found
27384	Process not Found
21400	Process not Found
16460	Process not Found

Uses browser remote debugging 2 TTPs 15 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2604	chrome.exe
1084	chrome.exe
24828	chrome.exe
25352	Process not Found
2384	chrome.exe
2272	chrome.exe
18232	Process not Found
27428	Process not Found
4328	chrome.exe
2728	chrome.exe
23908	Process not Found
16272	Process not Found
976	chrome.exe
18556	Process not Found
12204	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\OneDriveSetup.exe"	reg.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
10876	tasklist.exe
21080	tasklist.exe
4120	tasklist.exe
25772	tasklist.exe
24560	Process not Found
1896	tasklist.exe
24076	Process not Found
21312	Process not Found
11532	tasklist.exe
8204	tasklist.exe
16212	tasklist.exe
19256	tasklist.exe
21248	tasklist.exe
16692	tasklist.exe
9620	tasklist.exe
11468	tasklist.exe
14184	tasklist.exe
14484	tasklist.exe
27228	Process not Found
26308	Process not Found
21260	Process not Found
256	tasklist.exe
2668	tasklist.exe
19348	tasklist.exe
27160	Process not Found
12752	Process not Found
25316	Process not Found
20408	tasklist.exe
21156	tasklist.exe
13460	tasklist.exe
24336	Process not Found
19580	Process not Found
2140	Process not Found
15544	tasklist.exe
20080	tasklist.exe
13964	tasklist.exe
17380	Process not Found
24452	Process not Found
7640	tasklist.exe
10732	tasklist.exe
5476	Process not Found
14540	Process not Found
21772	Process not Found
9680	tasklist.exe
7872	tasklist.exe
17464	tasklist.exe
24740	Process not Found
5316	tasklist.exe
2928	tasklist.exe
10144	tasklist.exe
13848	tasklist.exe
10084	tasklist.exe
11056	tasklist.exe
15480	tasklist.exe
15004	tasklist.exe
6748	tasklist.exe
14792	tasklist.exe
7288	tasklist.exe
11012	tasklist.exe
15736	tasklist.exe
27428	Process not Found
18204	tasklist.exe
23812	tasklist.exe
22988	Process not Found

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
936	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
10688	reg.exe
9748	reg.exe
4024	reg.exe
7988	reg.exe
7028	reg.exe
8272	reg.exe
21740	reg.exe
18740	reg.exe
9032	reg.exe
21092	reg.exe
13816	reg.exe
14972	reg.exe
24448	reg.exe
25544	reg.exe
22428	Process not Found
19764	Process not Found
5220	reg.exe
8728	reg.exe
11888	reg.exe
13792	reg.exe
21496	reg.exe
15772	reg.exe
22172	reg.exe
26428	Process not Found
7176	reg.exe
16460	reg.exe
8856	Process not Found
15340	Process not Found
4116	reg.exe
9852	reg.exe
10588	reg.exe
17076	reg.exe
10460	Process not Found
25244	Process not Found
19448	Process not Found
12760	Process not Found
12132	reg.exe
9760	reg.exe
23468	reg.exe
24032	reg.exe
24004	Process not Found
4996	reg.exe
792	reg.exe
19564	reg.exe
17824	reg.exe
26652	Process not Found
4312	reg.exe
7748	reg.exe
8776	reg.exe
20356	reg.exe
1768	reg.exe
9864	Process not Found
23212	Process not Found
19808	reg.exe
7372	reg.exe
8300	reg.exe
11028	reg.exe
11712	reg.exe
19972	reg.exe
12060	reg.exe
22188	reg.exe
24752	Process not Found
5196	Process not Found
8780	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
20328	Process not Found
7648	Process not Found
4600	schtasks.exe
14696	schtasks.exe
15028	schtasks.exe
15240	schtasks.exe
25088	schtasks.exe
25652	Process not Found
21844	Process not Found
27512	Process not Found
18136	schtasks.exe
25956	Process not Found
2280	Process not Found
25700	Process not Found
22032	schtasks.exe
22280	schtasks.exe
22372	Process not Found
15232	schtasks.exe
25172	schtasks.exe
17580	Process not Found
7132	schtasks.exe
14960	schtasks.exe
15320	schtasks.exe
25720	Process not Found
21840	Process not Found
10612	schtasks.exe
13172	schtasks.exe
21264	schtasks.exe
15784	schtasks.exe
25704	Process not Found
19700	Process not Found
25988	Process not Found
10808	schtasks.exe
11872	schtasks.exe
25072	schtasks.exe
6172	Process not Found
10820	Process not Found
20996	Process not Found
7196	schtasks.exe
25544	Process not Found
15212	schtasks.exe
15156	schtasks.exe
14728	schtasks.exe
22464	schtasks.exe
22512	schtasks.exe
26736	Process not Found
17328	Process not Found
23504	schtasks.exe
14704	schtasks.exe
16084	schtasks.exe
11356	Process not Found
8916	schtasks.exe
6320	schtasks.exe
22976	Process not Found
16004	schtasks.exe
14140	schtasks.exe
20356	Process not Found
6604	schtasks.exe
12000	schtasks.exe
17492	schtasks.exe
25180	schtasks.exe
24764	schtasks.exe
25304	Process not Found
19208	Process not Found

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4036	powershell.exe
4036	powershell.exe
4036	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	256	tasklist.exe
Token: SeDebugPrivilege	4336	tasklist.exe
Token: SeDebugPrivilege	2656	tasklist.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4036	3996	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 3996 wrote to memory of 3312	3996	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 3996 wrote to memory of 1712	3996	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 3996 wrote to memory of 4444	3996	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 3996 wrote to memory of 4116	3996	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4444 wrote to memory of 256	4444	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 1712 wrote to memory of 4336	1712	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 3312 wrote to memory of 2656	3312	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 3996 wrote to memory of 976	3996	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	101
PID 3996 wrote to memory of 1856	3996	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	102
PID 976 wrote to memory of 3664	976	chrome.exe	105
PID 3996 wrote to memory of 4996	3996	2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:4300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:4852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:4736
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:10584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20140
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        Clears Windows event logs
        
        PID:18652
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:1768
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:19844
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22400
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:21696
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:16252
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:17380
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10612
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        8⤵
        
        PID:24788
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20244
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9524
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:6612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:18100
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:21092
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:21224
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:21288
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19584
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:18360
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19388
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:12944
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:23032
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        8⤵
        
        PID:24224
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:25088
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        8⤵
        
        PID:22072
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:19144
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9532
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:10876
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:9696
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:9748
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:9756
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        Clears Windows event logs
        
        PID:14908
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15156
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:4304
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:792
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22264
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:19160
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:2840
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:8940
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:11012
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:10308
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:12008
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:13116
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9592
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:25828
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10592
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15416
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:12380
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15472
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:12904
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:21732
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:22080
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:24864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11652
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:5656
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6864
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:9680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16300
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:18544
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:18464
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:18696
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:17912
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:20992
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:18272
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        Discovers running processes
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:18280
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:20312
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16084
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:23684
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        8⤵
        
        PID:24480
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:25048
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:18956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7104
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:9300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:16536
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:19092
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:19304
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:19232
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:18476
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:18748
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:17468
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19240
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        Discovers running processes
        
        PID:15004
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13172
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        
        PID:16792
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:25104
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:19256
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6328
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:11008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:23432
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:7892
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:15632
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:22820
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        Clears Windows event logs
        
        PID:24256
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:25056
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:21248
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:7028
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:6952
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:7120
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:15188
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:8284
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:14688
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:13548
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22420
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:6540
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:25084
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9136
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:15404
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:19084
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:20000
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17384
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:21740
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:21808
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:20752
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:19200
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14468
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:14288
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:23672
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:19884
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:4024
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:2556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:4372
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6604
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:7124
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7196
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:7608
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:6804
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:8484
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:15268
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:6968
- - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:8736
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:10896
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:11028
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:11632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:11728
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:12788
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:12832
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:13096
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10344
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:14664
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:14892
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:8280
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:13796
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:21264
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:20832
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:11532
- C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:1620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:5116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6448
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:7376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:21124
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:16452
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:9112
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:22384
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22564
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22708
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:16848
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:25428
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        
        PID:20236
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20652
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6604
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:15324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:8160
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:11452
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:13816
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:19972
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:25180
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:21080
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7316
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:10788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:17884
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:19868
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:19972
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:20056
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19752
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        Discovers running processes
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:20276
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:18496
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19616
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:13856
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:7456
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:23592
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:24780
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20064
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:6380
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:6868
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:4304
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14968
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:15284
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:8776
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:9992
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:17756
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:17016
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        Clears Windows event logs
        
        PID:13652
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:13012
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:21544
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17784
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:21908
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:22628
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:14724
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:17824
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:22576
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:25468
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:25644
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:20760
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:6008
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9196
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10476
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:13300
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:21796
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11312
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:14008
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:12152
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11928
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:10084
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:14596
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14648
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:14616
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:10720
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22296
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:15192
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:24944
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:1560
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7196
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6908
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:7528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20980
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:19804
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:5280
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22668
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22636
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22684
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:23776
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20660
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6208
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9732
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:8300
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:9116
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:8344
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14696
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:15180
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:10616
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:12276
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:16036
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:15056
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:12256
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:19136
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:20072
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:20296
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:20356
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:21296
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:16960
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:19676
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:20612
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14792
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        Clears Windows event logs
        
        PID:20472
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:25120
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:20080
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v UserProfileUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
      4⤵
      Modifies registry key
      PID:5220
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn UserProfileUpdate /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
      4⤵
      PID:6568
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:7748
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:8136
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:6572
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:7824
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:4112
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8916
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:14932
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:15172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      Clears Windows event logs
      PID:7116
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:14592
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:9548
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10452
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:9812
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11336
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:19428
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:9840
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:12252
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20136
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:20256
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:4448
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:15628
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:11556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:21464
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:9852
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:9912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:7804
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:9660
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:14672
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:15028
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:13920
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:4440
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:22288
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:21044
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:19696
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11328
- - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:8068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:18540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:20964
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:9760
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:22604
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:22612
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:22620
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:17696
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:21752
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:18588
- C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:256
- - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:2972
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8184
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:11976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:17640
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19856
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        Discovers running processes
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19992
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:23232
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:21420
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:21556
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:21588
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19268
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:13344
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:11656
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        
        PID:21204
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:24764
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        8⤵
        
        PID:24600
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:19348
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7440
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:7448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:17604
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19628
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        Discovers running processes
        
        PID:13460
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:21496
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:21452
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19920
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:20580
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19320
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:21884
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:13040
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14140
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:16544
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        
        PID:25152
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:19608
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6960
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:12144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:23440
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:23468
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:22908
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:23508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:21736
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:21444
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:6352
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:7008
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6320
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12000
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:7320
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:708
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:15100
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:14732
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:14988
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:19504
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:19636
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7876
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:21980
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:22188
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:22352
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6948
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10572
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:18136
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:22352
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:20288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:20408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:5344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:8764
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:10904
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:8780
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:9412
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11684
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:12364
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:13848
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:12416
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:14340
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:24124
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:14632
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:14800
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14868
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:12440
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22160
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        Clears Windows event logs
        
        PID:18904
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:9268
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:2600
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:788
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8224
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:7428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:20808
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:14736
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:19564
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22648
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22700
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22676
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:21868
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        
        PID:24716
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20796
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8652
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:15040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:19664
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:15236
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:16292
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        Clears Windows event logs
        
        PID:14656
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:18344
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22692
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:23140
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:24688
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:25460
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:25172
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20676
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8660
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:12336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:21136
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "21136" "1852" "1800" "1864" "0" "0" "1872" "0" "0" "0" "0" "0"
        9⤵
        
        PID:18664
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:16460
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:14932
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:11480
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22976
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:22956
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:23120
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        8⤵
        Clears Windows event logs
        
        PID:24144
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:25136
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:21156
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:8776
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:8784
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:8856
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:15204
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15212
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15232
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:7224
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22140
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:21944
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:24724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:4872
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20568
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:22656
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13924
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:17076
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:22008
      - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:23536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17320
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:2368
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:3796
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:5196
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:6552
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:6376
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:7260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:7432
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:6676
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:8468
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:14736
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7024
- - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:8692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10224
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:10580
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:10588
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10364
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12896
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:16800
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10500
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13540
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:8908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14204
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:14884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:15132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:13292
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:15336
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:22244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:20688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:18344
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:11468
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:21356
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetupUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --remote-debugging-port=9222 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2 --disable-gpu --no-sandbox --disable-features=IsolateOrigins,site-per-process --window-size=1920,1080
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb4c05c728,0x7ffb4c05c734,0x7ffb4c05c740
    3⤵
    PID:3664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:3144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=1556 /prefetch:11
    3⤵
    - System Time Discovery
    PID:936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
    3⤵
    PID:3972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:2604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:8012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:24796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:24804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:24812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --force-high-res-timeticks=disabled --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
    3⤵
    PID:24820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=2180,i,2551331468938848177,5972750827492039112,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:24828
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn OneDriveSetupUpdate /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:1856
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsSecurityUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
  2⤵
  - Modifies registry key
  PID:4996
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsSecurityUpdate /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemConfigUpdate /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
  2⤵
  - Modifies registry key
  PID:792
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn SystemConfigUpdate /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4600
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:7416
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:7624
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
  2⤵
  - Modifies registry key
  PID:7988
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  - Clears Windows event logs
  PID:1180
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:8452
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-03_ca7f2629f2258459cacbe7c1d2113d75_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:8644
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:9044
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:14772
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:10776
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:10000

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
1⤵
PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:612
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  PID:1516
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:2928
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:6196
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:8380
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:2668
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:12940
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        7⤵
        
        PID:22328
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        8⤵
        
        PID:16056
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:23356
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:8804
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:15544
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:11668
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:16212
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:15196
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:13204
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:15628
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:22464
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        Clears Windows event logs
        
        PID:21664
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:16372
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:24736
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:24872
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:7872
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:21208
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:7712
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:23736
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:16004
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:17044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:8756
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:8840
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:11288
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:15480
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:11036
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:10924
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:16196
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:7916
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:7028
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11168
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:16144
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14800
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        Clears Windows event logs
        
        PID:21372
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15784
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:22516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11268
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:23976
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:8848
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:11240
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        8⤵
        
        PID:10652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:22424
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        8⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        8⤵
        
        PID:17780
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        8⤵
        Modifies registry key
        
        PID:14972
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:15464
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:18348
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:10764
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15380
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:4156
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15956
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:11352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:9880
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:16100
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:22168
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:22208
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:23504
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:25500
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:11012
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:21520
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:20692
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:23604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:16752
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:9032
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:9120
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:9128
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:14704
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:8556
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:13420
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:22016
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:12952
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:21452
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:6748
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:13944
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:13052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:13492
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:23812
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:10636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:18924
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:22448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:16496
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:8728
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:9072
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15652
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:10180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:13500
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15764
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:22388
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:22496
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:21416
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:16396
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      PID:25064
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9392
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:1380
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  PID:4016
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:14752
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:11068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:22156
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:20668
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:25436
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:8128
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13576
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:20696
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        Clears Windows event logs
        
        PID:24024
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:17464
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:13988
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10968
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:12356
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:19796
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:23072
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:24448
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:17808
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:25072
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:15876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:21008
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:10688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:9892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:9872
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15772
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:22488
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:20648
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:21264
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:7368
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8200
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:15684
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:12988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:13392
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:21452
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:23188
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:18740
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:22248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:24440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8428
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:16692
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  PID:2296
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:2368
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:14976
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:14556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:22132
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:15620
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20184
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:19808
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:14576
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:22236
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:23728
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:24680
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:14668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15916
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:10804
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7576
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:11832
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:10732
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:9748
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:11816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7644
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15780
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:22404
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:16004
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:6532
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:25028
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:25388
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:6452
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:22380
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:23340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:23628
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:25544
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:15632
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:13360
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:15844
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
  2⤵
  - Modifies registry key
  PID:4312
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  - Clears Windows event logs
  PID:6560
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:4860
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  - Clears Windows event logs
  PID:7424
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:7456
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:7868
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:8728
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:9092

C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
1⤵
PID:6180
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:6684
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:7640
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:14624
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        5⤵
        
        PID:11972
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:22772
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:10868
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:8444
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10144
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      PID:15128
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:10760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:10892
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "10892" "1864" "1792" "1796" "0" "0" "1836" "0" "0" "0" "0" "0"
        5⤵
        
        PID:13600
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:16024
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:20424
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:19428
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:15320
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:25484
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13564
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:2588
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      Modifies registry key
      PID:24032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:17132
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:23048
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11484
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:18508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:7100
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7652
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:13148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        5⤵
        
        PID:11064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:24060
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:15024
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10972
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      Modifies registry key
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:6404
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        5⤵
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
        6⤵
        
        PID:19788
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:22916
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:23804
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:14484
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:12088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:13308
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15672
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:22280
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:13480
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:7340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:25564
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13172
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:21832
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:22152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:20620
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:18416
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:17396
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      Modifies registry key
      PID:22172
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:16036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:15212
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:19696
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:12132
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
  2⤵
  - Modifies registry key
  PID:7176
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:7272
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7916
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11228
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        5⤵
        
        PID:22520
      - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
        6⤵
        
        PID:18528
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
        6⤵
        
        PID:20352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:8556
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
        6⤵
        
        PID:16976
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:24100
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:10724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11380
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11052
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:9304
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13068
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:11388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:14424
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15860
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:22428
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:16988
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:15888
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13788
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:9124
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:23920
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:7308
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:7360
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:7484
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7132
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:4372
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:8924
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:15220
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  - Clears Windows event logs
  PID:7268
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:11944

C:\ProgramData\Microsoft\Windows\SystemConfig.exe
C:\ProgramData\Microsoft\Windows\SystemConfig.exe
1⤵
PID:2844
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:8144
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8004
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:14952
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:13508
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9516
    - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
        
        C:\ProgramData\Microsoft\Windows\SystemConfig.exe
        5⤵
        
        PID:22416
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:23872
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:9168
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:8204
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:12460
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11144
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:14948
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      Modifies registry key
      PID:13792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:10736
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15704
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:22436
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:13256
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:20900
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:24704
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:25492
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8288
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:6856
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:15928
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:23604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:7312
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:7508
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9084
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:15140
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:10536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15248
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:11936
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12408
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:8040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:11056
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:7876
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      PID:13576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9860
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15948
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:22512
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:22092
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:15240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:20528
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:15320
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:17996
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:18336
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:18900
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:6672
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8516
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:14680
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:5220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15588
    - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
        
        C:\ProgramData\Microsoft\Windows\SystemConfig.exe
        5⤵
        
        PID:18152
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20964
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
        6⤵
        Modifies registry key
        
        PID:15772
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:6596
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:15920
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:13964
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:25476
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:8476
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:9052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15488
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:8244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:14184
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      Modifies registry key
      PID:11888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:10172
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:16000
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:22032
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:22456
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:14428
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:25452
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:7288
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
  2⤵
  - Modifies registry key
  PID:8272
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:8280
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:8368
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:14712
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:14728
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:14960
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  - Clears Windows event logs
  PID:7596
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:22072
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:19028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
PID:7496

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
1⤵
PID:7388
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:11996
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
  2⤵
  - Modifies registry key
  PID:12132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:12232
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:12220
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:10044
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:17480
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8436
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:10080
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:20520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:23828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:24496
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:24852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:25772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:24536
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13524
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:25144
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:24276
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:10552
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:9564
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:24588
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:14640
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  PID:15072
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:1188
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:7864
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:22256
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:21200
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:25596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemConfig.exe

Path C:\ProgramData\Microsoft\Windows\SystemConfig.exe
Size 6.7MB
SHA256 87b9bcfe0669495f1c149aafa02ed8ae459834314a6f6c140a0b628c959e29b4
MD5 ca7f2629f2258459cacbe7c1d2113d75
SHA1 3c70d22a09944b4cb2f841b9ec9a9a6fb57b13df
SHA512 33cfa46abf3fde7ea65b10fb2354ee6b617dc60cf35641534063c457752c8272365dc7d883ace54e918c20982655a07138ef319cca2d4280c5fd5a8a12336d5a
SSDEEP 49152:JJuUdcOsBiichOqlrfOrJfD0/C1zh/FBHXa+SXMALucbpIlaQ4/X2jM865npKKQh:JJVdnwOCbScq2AhnY7XFHEI
TLSH
T18F664A07ECA515E9C1ADD2358A739512BF717C481B2123D72B90F6283F76BE0AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3v12c4al.ty0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3v12c4al.ty0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 33b6820a4cb04857d52f2fd42eb2ca9b2e4a20b40e1ccc3582f7de6eb0ac2887
MD5 0cf97d4945f4108cabf1d678700acedc
SHA1 20d076e191014b628f44f66f364750995b6a55ee
SHA512 9355fa2d3aea234d146e71c23efe2c3391861ce4debee177d74dd4d4ec63992334af4b922d4a383fd94c86e0e9bc087d3a0eeaa4d7d3844fc95c3395e4e70365
TLSH
T14AA002B253D01C01EE440270E4670A81AB51592401916B63D5D1D495895B7E34146941
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0aee.TMP

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Code Cache\js\index-dir\the-real-index~RFe5a0aee.TMP
Size 48B
SHA256 9996323ef9118b5a6150fd62f3be2b0c4e02dcf52e127740b914605e4645cbd0
MD5 ebb6c2bc7001cc5487850bc96c1ee278
SHA1 5b48e3730f40e0abf6249efb6a4b06425c3c4984
SHA512 dcca57ea17902ffa3521b872df5e6f1dec70affb6ac9772fd5660f32eeafda3bb904c8a5ba3086735865aebcae0c3574740df82f9307dc41d0ebe73b6ceb653f
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Network\Network Persistent State
Size 879B
SHA256 9db15d1ea08f63ccb7b481d3b0c6250373acdd98543bf6ff03b17967069b79c7
MD5 cfa3337681f0cc9b7f8e266ac6e00540
SHA1 05aba34c088782f10642c58d1a23dba076c025af
SHA512 d5d8661f3a15b5ad2795151d97f5e6c9d42c04b6b44b7d728b81f414e00042c9b6220a57e3ce58aa93a823166fe50d16882b51455ca4a2efd95e6195b2e20b47
TLSH
T12811CCF7C2D8957D8A8042F4A7156E1BCE2E0904531E3C5AC4E8AE2F97E28B1A10049F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Network\Network Persistent State
Size 2KB
SHA256 d7d7b8122a66b8ef71aa85c55e2a56abe50f885a6abe3e296cb755697f33c9c0
MD5 102f16038b642f4a0025bee4925cc59f
SHA1 9d151d740b29ea7334ebe0224f0e814b0bea7378
SHA512 d793fed573a2bad9f9148c88aad6241e090a20ab78517b68d8015ad72330a86b21bb3b3ac39fe6a2489a6d94be7a3d4d4acf33714c5bf8592c1d2457a99c7b8e
TLSH
T12D419BF3D3D4DAAD850166E49A217E2FDD3D0A14121D3C52C8E8EE8B57E24B3D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b3eea.TMP

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Network\Network Persistent State~RFe5b3eea.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Preferences
Size 8KB
SHA256 0378cfb586f1a30b1ba92cf0d84adeb8c13928e14cba3624b408e1b7e8edf213
MD5 1d35fda8f235a276b050c5c40cc138e8
SHA1 49fe4162e6cd1a8ab34f97b6d3b3c3c3ff1ce825
SHA512 0bc78b2091a23e4acb0f8a21ce9086f33d67e444fcf9ff9716e92e85f40e8dffe0a8dd6a10da34d1f74713ca6ce25eefadb0da9a08a9dd2f21d77be37cb4cddf
SSDEEP 192:3RRS9v7FvAPRp2/Xsb+WNn2Q2duiyIsnAUgR:3RRS9h6X4XwP2pR
TLSH
T1D1027229AD28A53B4CC7E219FD357B42E2F6102175D52D0CEBFC892C15D76CD222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Preferences
Size 8KB
SHA256 0412ca0520906ed4018d8a5a368b96079f22e9ff6eb7df805be7a18ffb531774
MD5 944b3bebf3bbc1fe52338417078f0795
SHA1 ebc170f1ac15b14c95dab5639a90b2f5ef145967
SHA512 d00570b8cb07dd0c01de54d4ccc75701b8374f628beeceebedb64a46e6b27ed43d8ea28e75371a18bbe9c617f1d1013acb561aee58f442af602757adf510fae9
SSDEEP 192:3RRSnv7FvHPRpR/Xsb+WNn2Q2ikiyIsnAUgR:3RRSvhnXZXwP2cR
TLSH
T162028329AD18A93B4CD7E619FD357B42E2F6102175E12D0CEBFC892C25E76CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Secure Preferences
Size 11KB
SHA256 e879864c5de2c1085c5e959bd402263ed25bb5d6f855e9f966b9a7b7832d6531
MD5 bb7c82243eb60a014a65c03ab701eb93
SHA1 622f95ea6ff269c9b507b4cca6ad538f29acf7d8
SHA512 ec3668ed21db35f611b76a9ac8021a2addc0719f3fbb81dc44980eb2431c864046beb1bea2da09c0f356bba641343d2a2f24b5f342f7e80f118bd1473bcad500
SSDEEP 192:e564K6Bd7KxkXqK4I40pUZNCgVLHrKHfFKOeXVXzKD/29+ErUkKNaj+1OE40c:E6jud7KxkXqKf/pUZNCgVLH2HfgOWVXd
TLSH
T15632C927A48D9A3F4FD8E50CDC136F4BBCB502927678092896FB9C0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 19c84e849548c665fd50c9b3649a9223934157015920f72c2b11dc53983faca1
MD5 a9b507fd8c91cfc38ad16f0359e02f0b
SHA1 133abf408cb38ae0e84b0f3becc1963512ffae54
SHA512 dcab946d6744606341f0e0409b50d3d4198fe4c7cda96100e03479808b4c7c7c9f4b941d84ee433f67efb81c56d974681ad6b583947f951688e5794823685beb
TLSH
T1DAA0047341C10D11CC04C3F4104D05D437155F354145DF0353D447C5DC571F443554D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a09a6.TMP

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a09a6.TMP
Size 72B
SHA256 704113cd25ee8353df7065bf39d3d65d3909b25803788f874c253f83f528eb34
MD5 4190b1cba6b37192bf1a466b1457ff5b
SHA1 7c24ab3ed249bc4fc00ca771dbdcc904fb8a3b13
SHA512 68c2c6e67e921003f3e9678b25189b5470873612c64b152946468b1661b7acb11668f3299589a6f625adc7141e01f00f38aa084ca263df93b0d582728c9ad2e3
TLSH
T118A0026252448550C50802B42C0587881780BA2580400713B7D0434B8C700A44995565
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e7bbf11a-fae4-479d-95f5-2d8c2b989ccc.tmp

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Default\e7bbf11a-fae4-479d-95f5-2d8c2b989ccc.tmp
Size 8KB
SHA256 dd85327358ea49cf58b70ec7f323b9c4b79f888f932400f0ce6ddf07eda2cf2d
MD5 579c7925eb1a582f95008e507297e623
SHA1 2a144d8a3b2b5c21eba4842f098c9e8d1c7bda29
SHA512 b9156b58ccdb4ee4af881098eda9f3cedb8aedd264b6bb365ecc8d5b459e7b0618b5aea2aacba85d98244df108345cc938b8d35b5729c850cc8a124757f8432a
SSDEEP 192:3RRSnv7FvAPRp2/Xsb+WNn2Q2cuiyIsnAUgR:3RRSvh6X4XwP2mR
TLSH
T131028329AD18A53B4CD7E219FD357B42E2F6102175D12D08EBFC892C25E76CD222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Local State
Size 3KB
SHA256 8e9346e3f9cc1774fa8022f330048b0d946047cf002c1308249e8111431fec0b
MD5 c694e85077f1444edf09f8cea841c01e
SHA1 398881a5a3e70d7c218b2b360ee06c3c1b7df4ed
SHA512 696f2dc4ad137d2723e9861e30e159d9337826ff9f856249bd5a03cb19e4da09037ddc05b137f264cc977aa6eb55385fe094647deaa766b8fb6a5a09148caa21
TLSH
T19681D7B2B46D9D7348B6D404F8163A43DE74A15AE5517E88E9D80F1C11EB6DC2306927
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Local State
Size 3KB
SHA256 cb4d1cafa4ec01a51616506529a604ec3ddee415ca42fa443e36cab981a8c68a
MD5 7ae1cd01c25b6ef40d1a71e42d5985e8
SHA1 34905d47482e99b7f6dab44520d97f0bcc12f562
SHA512 9947fcba1ce320f9eff19cd4ed2da877aabe84209e876d9756036a670928d7deb8662971a7947b5376de96ae47eef25439480a1bcd93afa9c594dfd321791fd9
TLSH
T10181D7B2B46D9D7358B6D404F8163A43CE78A16AF551BEC8EDC80E1C11EB6DC2306927
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Local State
Size 127KB
SHA256 e4da742f6ec5e27025d3af7878be7c647601bacdcd2a2f54d180421ddcaa9312
MD5 15ad9ef39680e4edf331d3cecc256e17
SHA1 a7c47b4a50da3ffa5469ea29abbe9851c9f5352d
SHA512 caa9e719646ed959eb5dd87e750f4e76f98ce02d21a025cd919301bc27da4871b7f327460801bb38fd4fecc953cf00044ecfbe7547fcf9b45e4029db28ca2f6d
SSDEEP 3072:YXguczvjfetUdJx6TzNn1xRKaVoNOVoZ19sX:YQPzvrwMSzNn1xgolq1SX
TLSH
T114D3127A55F9893FCA248CC8853A2F4D5967A4D08943CED01FD7A34C667CDCA2B37468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Local State
Size 4KB
SHA256 1b1ac4d8a9bea28cf3d259dd9bea816718b6b23e2960c4603c4d29f9b4ff8b40
MD5 43cb451a63a19624340f6e0c4334f44a
SHA1 5baf365840e2c016d8a5ae80fca4367ad1f0ba23
SHA512 3ed8dfac40138093ac5904a55e5ba91f68cc8c46a662a2b31efb7635af1d80d92f9ff41dd02de402dc0d8186f7b1df58171663c89273b9751704e2a18564d8a1
SSDEEP 96:QbJ6Efw3o4KRDotor5O9DNB6RGyve2GKaIjuG/hHR0j9Ia2/V4a:QtUuDUWyTtSaHG/hHRUB2t
TLSH
T11D81D6B2B47D9D7358B6D404F8163A43CE74A16AE5127E88ADD80F1C10EB6DC270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59e092.TMP

Path C:\Users\Admin\AppData\Local\Temp\chrome_debug_c1c5f2\Local State~RFe59e092.TMP
Size 1KB
SHA256 e57a7c4b5c3b3481109033a82e67f66589106cc47efd69b3b7000d676e4b6ea5
MD5 2ebe8f7f326b2eb26585fa8f7b80d20e
SHA1 a53fab759580a5deb912ec42bd9c8786786def01
SHA512 efaa082a61c06f886e9ac03a1318b24030e736819aa178665bc09b36ac6734c3e2455db83e22141af42b46f4d2f804c5a4380a53af7c127defac4f70808e00bd
TLSH
T10F1175717C3D62A19894C808FE1897B76E29922BC052D9483ECE0E68356B79C7527C39
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 747c54f5cf9912ca13300a9fe8fafa7992e5e5fb533ed8d364cf99fc2d420f74
MD5 362b1673bd218c1f1f052eed492803ca
SHA1 cbeeb5b187560af3db0816cc1239661644548e51
SHA512 677e84a4621038d3d9646a6049c6db342c250cf119c5b380fb80c776cecec0bfc9474bf731e3a6b05ade6487d33c4959f896a8b51120a6bcd153ad85a47114a5
TLSH
T13C90020923F88814391A1453A85257063B066EA54404D64445A6200E313088B0743414
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 54a2d124ccb2e2b0d12ed78a555af3adc2bf340c5c9a85e0004dc9bec29deebd
MD5 9231b62b1d208adf1dc9b3980b253ea9
SHA1 3a8dceadd8c21ca9e68b660ef564c36ee6aef519
SHA512 caa6c043f2695659797576c4c0849262e561a3b8ab1e6097fd32966149a19d4e5689e15d1e67671cb602d405fae5ea4910492eaa62adfcb271ba1ef20e413a96
TLSH
T1B390020963F48814391A1453A85257063F066EA50404D74489A6200E31208CB1743414
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 bfec8d690d3eae98c08a41617438eb69acbb89cb9ff472509425e2417a9d6f43
MD5 31b681f45c6733fd2ac93a537495ffd5
SHA1 ed9065a1a31918cb77d4afe80fd34b6688da0c6d
SHA512 f643f131d2872669e711d89df932eb2334c9de64dae76c5a6bcfb16525535093745e255551d7a64239c8ddb70a13f97d7750d5d4f877f88141a20ec4f779de33
TLSH
T12290020923F48914392A1453AC5257063B066EA60404DA8445AA200E313488B0743514
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 14aae467e17c61e22c8a2c879efba3c29263b73b3193ac89461d4021953539ba
MD5 59ae5c5ad604257f6231e6730b410f4b
SHA1 80f4283d705d1bef029591b6eae0ba47287b8c8a
SHA512 103521698e7d89b1f187acd68a729010ac938acdbaf5e0b4a37a3cfc113735212c23a175995eb82224dee46f3699f0a36d87ed065efdb3f9c952eab4a3698e2c
TLSH
T16B90020923F48814391A2453A89257063B066EA54404D64445EA300E312088B0743814
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 3e5a7c400c94a82f3e0abe39005ef9d80fb306f9fba6e9886b41ad90e46c69fc
MD5 46ccf178bc72b2e0754e9f75252e75c1
SHA1 aface0ac65d985223bf340c30f8b63ab4d56817c
SHA512 78d931d83131565e9cef59699f74e57302ca0fcdce58360d83c87199da2d9c3d222aa4fd328f9eff44feaebecb10ab951556acf91024112e0697c69ddff9d944
TLSH
T17590020A23B48C14392A1953A85357163B06BAA50804D64445A6204F311088F0603414
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 54d906077cc9582d94d682e4f1467885eb4b24e87005e7c71284b829f9afe322
MD5 970391a43d22f64393bb6059690185b7
SHA1 ddb72edef89b5b546b7ac314e3e5a167cb6df91c
SHA512 b9cb843dee64cd2fef02a5f644058f028c0ac75c663059d9076295501865cb75cd5d2d388a8e3a5cc9068778c62cc96fe93155d82152adc88e846a1b2f7a7816
TLSH
T13490020D23B48C14391A1553A85357063B06BAE51844DA4445A6604F311088B0603824
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 0ed1d65016d4e43deaf8821ed8aa930a0e87cf23cc5c01c91106ab65c739b43c
MD5 0e398bd5b858f866feec0bd024acadaf
SHA1 b3dfa9e913926d87ebdd77716e681ccb9d41a65d
SHA512 ac75f73e0ef62489376faf259487a475cc5e63c47e40ddfe614dd5a285e48aeab57536787152a5532c075551f7c9eda2bc75cae973cc5a1709da000180cbfb11
TLSH
T16F90021EA3B4881429191463A952570B3A076A894404D6D48576200EB02088F0603414
MD5 SHA1 SHA512 TLSH

Submit Download

watchdog_task.xml

Path C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml
Size 1KB
SHA256 d8ed39f0b3d797c37a62fba2188118a4e1d785136f5fb97cb5a0f76998a2869d
MD5 0120475740381c0b05612d4f1da6aa24
SHA1 f6b3d38a083bba7743275146bce923da085a045e
SHA512 b8be967d836d8225cfed572dbcdd560bf3e3e52807dea515dbe196c87b681e9167e71edeaf89260de3cd404a78c8568040b8dc11b0b996ab206e83a17b48dfe0
TLSH
T14B31DD64A9F0B36BFA534539C25166421F65977381134134F9CC4E7C7FCEA8AA14362B
MD5 SHA1 SHA512 TLSH

Submit Download

agent.id

Path C:\Users\Public\agent.id
Size 16B
SHA256 047b118ab27b69c59446fff8621f1daf5640135342343e663100613773f365c6
MD5 6da1a074360e3076a185066b8fc7c738
SHA1 4feb7cc53ee1205f46512d17987acbc2d83002d9
SHA512 d686fc67c769a5039d8a1a7acf0cb1e9e26519c592cf47c837f2f52a7ea7b5d98195bb0cbd8a82fcc8e86f99759cd5f2b5bd139e2800e1eab441a500e9f69ad9
MD5 SHA1 SHA512

Submit Download

browser_c2_mode.txt

Path C:\Users\Public\browser_c2_mode.txt
Size 35B
SHA256 f0301f60dad512d53efa922be8a71ddbd70ac2c8a543e68325ef3d4005de218f
MD5 0965d69736af826cd6a2a6865febbf11
SHA1 dad0c8c78f3eeeb5ab827b553c0749ae336d001d
SHA512 6b8c158fb243d92c1f6d4305e8faf2b3e1d66f5804288c85baff11037431ecc1a5fcc401bb83654a13ccffd021907d43c2cbfdccc0e3271bdad906f9f1479429
MD5 SHA1 SHA512

Submit Download

browser_c2_success.txt

Path C:\Users\Public\browser_c2_success.txt
Size 78B
SHA256 2316788ce74bc2b00e48acf41dd710708e2d481bd01d4b8f008a236bb97d12ca
MD5 d319a505c9ee081fb5b83c0996832652
SHA1 094d657dcdf002e0f9633f8f9aeafa719f819e63
SHA512 a7c8e6c75823e3f77a5b600557dc4f2f5355fb2351e88776a47e7a721a4fadf6e0703e4e94af356c9e94af1df3a8d570351c7e7c826a14cada12d5a2c19b56ec
TLSH
T162A0228808FB2033B0030C332A222E88BA00BC3E8280EBAC3F230B0B0C000CC2F00202
MD5 SHA1 SHA512 TLSH

Submit Download

browser_c2_success.txt

Path C:\Users\Public\browser_c2_success.txt
Size 78B
SHA256 33687a5f98c3b7453de175e5c79d57e8051523549c69e5655dbc2c46fd93e311
MD5 97c42b07dc2143feec11c668ddb20aea
SHA1 0526e249e471a228d69aa90b321de6b4373ae3c9
SHA512 271dd86152a280af746b46c36fa30a4c09cc3474761d3f14e97af508739f38c893755e57ceaca2d585651440bee08d3588d131eb98341bb880c1f1401f5d554e
TLSH
T1E7A011880AE80822B0830003AA222A080200B83802808AA8AA82A22B080008C2F0008A
MD5 SHA1 SHA512 TLSH

Submit Download

browser_c2_success.txt

Path C:\Users\Public\browser_c2_success.txt
Size 78B
SHA256 63bd63e8841c2c458f0eb40b9ade81fba98379c7a582cfe0d2ecef77e9f7f178
MD5 17bfb3a57f0a48e5dac4b2f366069420
SHA1 e5ccf721f421207967c7bd1966fe7610045071cc
SHA512 5f91777fdcdf421f1eaa9a46db9093df0e9444ec6d74e026ee5de783f5a46cfdb50889096c0d723d3f9503bdf98a0217f9377b8a7be7968b502cc83626b5b3ce
TLSH
T1C4A0245C00F50431FC03404375355D4C0100F73C1340455477050313C5004CCFF40444
MD5 SHA1 SHA512 TLSH

Submit Download

browser_c2_success.txt

Path C:\Users\Public\browser_c2_success.txt
Size 78B
SHA256 44eac3195ab31d89301c3bedb3b0f3a2727ba30e1e058e08e363ee19e9054109
MD5 768230eeebfe66336162f3c9dbb02468
SHA1 741b82c1617ade0e435a298db23ffcc4009e265c
SHA512 4a91ebcfeb16f016a64e68f1cf8c7b3d1896aa08895f832c55bd1cfab31435e44920c4ac4d23b47b42388eb3529f5abc3c0abef3e2e51b28bee317c66cd55bb6
TLSH
T17FA0125400A401237522442228225B850604746C017145CC36010206091004D2F00002
MD5 SHA1 SHA512 TLSH

Submit Download

browser_c2_success.txt

Path C:\Users\Public\browser_c2_success.txt
Size 78B
SHA256 c5de914b19e9edb959cb852dc99115140f96c71c5c621c2e5f6f48c523e9ab30
MD5 9d34b1e333d7b048629893a93f7e8805
SHA1 c0529281655e908f27910960bbbdf65fcf11f949
SHA512 5537c49f6a0e422473216aeb58920294e006ba42aa41b314cdb5ff8b8b879c00fa5a7e89d61e2e3ae4257afacbc89d5ae93c035f2935dbd8e870d353d11f3e5b
TLSH
T1BDA0228820BA00A2F022380328282C0E82C2B82C0BC20FFC3B220A03880208E3F82C02
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Users\Public\debug.txt
Size 33B
SHA256 dc342b3f1f113035a18ffe23c1209a6331d769b998cdc28d5db21af6ea5887fe
MD5 82d4cf254f2f370a54c42c149003ec28
SHA1 49baaddf5f7808380439d57a641a392a72827a63
SHA512 402f612108d1641b2662d505e7a6d66836536ec74224eecdedb6693dbf4518d0d96739d1bbf6a3f0e9a1ec8c1b4cf68784a90e9afa11c730d57fe8ccb6045bd9
MD5 SHA1 SHA512

Submit Download

debug_error.txt

Path C:\Users\Public\debug_error.txt
Size 133B
SHA256 293da7750ce0bd2bc2d12add12d27b2a4354115feb4d15fb73e713fe4c4d1868
MD5 606c14c1794af1d1c9790060db10f9a6
SHA1 00146d4745bcf92069c6db8d7dcfb3d81149700c
SHA512 2eaccd5aba6da945853308b7c13a4c433276f3472d1a217cf00e3dae5f7a5b36d01e2ab637335bdd7a2f4a22ee33c1bcac02b59a5b047958f2d7b10c5f631b9a
TLSH
T139C02B919A132023AE0082C1412268C7312B002D0F41C07191EC800DF9810D4D02DF00
MD5 SHA1 SHA512 TLSH

Submit Download

protect_success.txt

Path C:\Users\Public\protect_success.txt
Size 51B
SHA256 320b9defc1854e7a0388f9ff2c7ad83a6a4c21206078a824d39fc8e76b5f54f9
MD5 66c5ce98e7c980a32c62fdb9715f66f6
SHA1 cedd445ca46850a4b985641495f12759e9a2a921
SHA512 46175c6cad063a9a2180f58017e228e64829344a3c1885805aea1275f1a1a6549d91a174102ebe310cc36582dde45336274b5108a0f62bbe507facde0ff87017
TLSH
T1EC900281104696054596899751814B67E89E74041479A19014D45746854520542066D6
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 423B
SHA256 b0fd3e6941b9f677f2b0694f7837a440e905fa2bd74be26e764b10f36a9c0a6d
MD5 1260e98fbaef2b092ab31bc7dfc3b19e
SHA1 e34b519c013fe8eb7929a6eeac8b1b0f2f89c2c5
SHA512 e617cd5473e0ee9f797bb5698c43173ffd0e1f1eec22340775c194c65bd7b25f8c9e8dc6b89aeb7568aa5f4a8d2fe543ba5e924f34a8658d5be3be62fdedd440
TLSH
T197E0AB01E36989568202B73674E2623EFC0C183D03070B10DE3D848E2F50A5F8744213
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 355B
SHA256 53f8a8ab7879e7372493593727408f393795325282d479cf361bbcc947022028
MD5 ab28e31e06092cceab02104213b5ff98
SHA1 21c0712ae3690e807fdac6412d48cbc76caa8a89
SHA512 ebefa972671220136c697eab0528144088d674481554a34088885a163492698bf1fa463dfab9bb3a700f95f2c912ab53deac02d1137dcdee2bd6a1e0546bf8fa
TLSH
T130E02605D6B98856C213BB3674F6762ABD5C102E030A0B05ED7D559D3F449ABC749143
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 342B
SHA256 9207ff7650394ede8eaee1254609eda60865af9aacf3c5269ba7f52a5e0db528
MD5 7dfaa8a0ac44fdaa247063f5a7b0be10
SHA1 72e41b9eec6adf23c8005ddfe3dc4c3da32bc18d
SHA512 7deca68841436d783c6efb8369ce23dd4dd3eebc830cff6f4830226cc1882c4dc9d33fc5e865b0cd0cf43adfe9a73296410035c0b67e539b374f0023bf8df7e7
TLSH
T11AE02601D2BA48628202BB3674F5732AFD1C002D130A0B10EE3D859D7F0486B8749203
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 381B
SHA256 afe97ea34d6592ede01244c9225a0edd6256d96c36a3550e25cb24ac8c562c3e
MD5 8ab012810a080ccd5bcb4e2377418cfe
SHA1 079af5bd8ef369ce46cffe83d66a75c317767ef1
SHA512 2def73314877d521710cba13b7b094b37ac83b70a06e546789723c2281726b14fbbe205f9d707b91ef9e896ac49ed4c48118368211df8000ccdca1ba9c9dfb3f
TLSH
T1F2E06801D2B84453C213BB3234E5772ABC8C402E130A0B11A92D459E6F04857C648103
MD5 SHA1 SHA512 TLSH

Submit Download

stub_watchdog.ps1

Path C:\Users\Public\stub_watchdog.ps1
Size 285B
SHA256 14d2e7a7ebefb76a5466318e2be7bd5849d1792c4d9a042cab3b7cd56cbadc10
MD5 d8c5396c15cea00f59e58c152faba597
SHA1 38f85d423f3379313a8c3206a4f7e73a8f1edcf2
SHA512 5e03ba1da6e084336a0daaee5e48b35a73ee675f923e43ae2fae2468a8c80dcd8c624858649ac9d44f57880cf1c8a3d30ed61dc03249f6685cbc12ebcb415594
TLSH
T197D0C200D26A45428101B72A74A5B36FFC5D042C03061724C93E849D3F0485BC749252
MD5 SHA1 SHA512 TLSH

Submit Download

stub_watchdog.ps1

Path C:\Users\Public\stub_watchdog.ps1
Size 366B
SHA256 3aa4663c88d01d395f664dfa0769eda212c19df7aaf693d3f13f4e414220e296
MD5 00d37f7baa22cd89d1cdb6e36a3b3808
SHA1 3844f833dc60cef857434cbb5f9a255e254cfcd3
SHA512 620ff81891e11289e85b20cc8bef385e07b62d76ee1ed304c717520f5796777d30158de4e18ce9e2104061992eba6610e341be0336449916ceb11a67c16ac203
TLSH
T1C6E02001E32A89468106B72AB4E6777FFC5D187D43420764CD7DC88D2E5494FD744213
MD5 SHA1 SHA512 TLSH

Submit Download

stub_watchdog.ps1

Path C:\Users\Public\stub_watchdog.ps1
Size 298B
SHA256 46e93e01dba6bd4c798ccce289d64c3cf0e05394f29a74fb4317e0e6ea1ec2c6
MD5 8df52e664562a697e4673005f43104dd
SHA1 e1fdb85bfde9894824fecc5aefa638e65a7a06c7
SHA512 2b0126078831c0f09996bcd1985ccdc2537af6d56d8ce594b48a4d0af34e413aa561b3c6ba6c8092c2cbd9c29f7da4f73f16ad2f506b8e61cae1bd9a486a1239
TLSH
T11DE0C204D26A8946C212A72AB4B6772BFD5D042D03051715C97E989D3F4489BD759152
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-1576-0x00007FF64D6A0000-0x00007FF64D6E9000-memory.dmp

Download

memory/4036-9-0x0000024B52050000-0x0000024B52072000-memory.dmp

Download

memory/4448-989-0x00007FF68B9B0000-0x00007FF68BA0B000-memory.dmp

Download

memory/5116-1658-0x00007FF622EF0000-0x00007FF625602000-memory.dmp

Download

memory/5116-951-0x00007FF622EF0000-0x00007FF625602000-memory.dmp

Download

memory/6008-1035-0x00007FF622EF0000-0x00007FF625602000-memory.dmp

Download

memory/7456-1058-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/7496-353-0x0000020127910000-0x0000020127958000-memory.dmp

Download

memory/7892-1053-0x00007FFB72F70000-0x00007FFB73311000-memory.dmp

Download

memory/8248-923-0x00007FF71A1C0000-0x00007FF71C8D2000-memory.dmp

Download

memory/9564-990-0x00007FF7CCE90000-0x00007FF7CF5A2000-memory.dmp

Download

memory/11064-992-0x00007FF64A300000-0x00007FF64CA12000-memory.dmp

Download

memory/11176-1405-0x00007FFB72990000-0x00007FFB72ADB000-memory.dmp

Download

memory/13652-995-0x00007FF7C8D20000-0x00007FF7C8D69000-memory.dmp

Download

memory/14120-1685-0x00007FF64D6A0000-0x00007FF64D6E9000-memory.dmp

Download

memory/14576-922-0x00007FF71A1C0000-0x00007FF71C8D2000-memory.dmp

Download

memory/14680-1772-0x00007FF7103E0000-0x00007FF712AF2000-memory.dmp

Download

memory/14772-1541-0x00007FF622EF0000-0x00007FF625602000-memory.dmp

Download

memory/14972-987-0x00007FF68B9B0000-0x00007FF68BA0B000-memory.dmp

Download

memory/15624-1829-0x00007FF7858F0000-0x00007FF78595F000-memory.dmp

Download

memory/15876-1082-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/15932-1720-0x00007FF630060000-0x00007FF63009E000-memory.dmp

Download

memory/16004-1064-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/16848-1025-0x00007FF622EF0000-0x00007FF625602000-memory.dmp

Download

memory/16980-921-0x00007FF71A1C0000-0x00007FF71C8D2000-memory.dmp

Download

memory/17996-986-0x00007FF7103E0000-0x00007FF712AF2000-memory.dmp

Download

memory/18036-1009-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/18336-1071-0x00007FF7103E0000-0x00007FF712AF2000-memory.dmp

Download

memory/18696-920-0x00007FF732130000-0x00007FF73216E000-memory.dmp

Download

memory/18940-1555-0x00007FFB72000000-0x00007FFB72013000-memory.dmp

Download

memory/18956-1068-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/19144-1061-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/19200-993-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/19256-1081-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/19608-1049-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/19696-996-0x00007FF7C8D20000-0x00007FF7C8D69000-memory.dmp

Download

memory/20124-1665-0x00007FF622EF0000-0x00007FF625602000-memory.dmp

Download

memory/20520-1062-0x00007FF7CCE90000-0x00007FF7CF5A2000-memory.dmp

Download

memory/20696-1001-0x00007FF68B9B0000-0x00007FF68BA0B000-memory.dmp

Download

memory/21200-1722-0x00007FF7858F0000-0x00007FF78595F000-memory.dmp

Download

memory/21380-1721-0x00007FF7858F0000-0x00007FF78595F000-memory.dmp

Download

memory/21400-1672-0x00007FFB728B0000-0x00007FFB728D9000-memory.dmp

Download

memory/21452-1078-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/22072-1069-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/22236-1065-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/22636-1057-0x00007FFB72F70000-0x00007FFB73311000-memory.dmp

Download

memory/22956-998-0x00007FF622EF0000-0x00007FF625602000-memory.dmp

Download

memory/22976-999-0x00007FF622EF0000-0x00007FF625602000-memory.dmp

Download

memory/23032-994-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/23536-1073-0x00007FFB72F70000-0x00007FFB73311000-memory.dmp

Download

memory/24024-988-0x00007FF7C8D20000-0x00007FF7C8D69000-memory.dmp

Download

memory/24032-991-0x00007FF68B9B0000-0x00007FF68BA0B000-memory.dmp

Download

memory/24600-1077-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/25244-1379-0x00007FF79D250000-0x00007FF79D2AB000-memory.dmp

Download

memory/25468-997-0x00007FF7C8D20000-0x00007FF7C8D69000-memory.dmp

Download

memory/25564-1066-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download

memory/25752-1067-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp

Download