704db39eaee2ba746ddcbb8190e51c56ba91e70887aadf27b2c104c34b9d181d

Analysis

max time kernel
2s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.6MB
Sample260905-daxx5abe63
SHA256 704db39eaee2ba746ddcbb8190e51c56ba91e70887aadf27b2c104c34b9d181d
MD5 977856f47060b0eec6b790e7586b30a4
SHA1 213bcec01fb77879d94f84bf449760d3510a9bc8
SHA512 177706e01723caaa5669353931bb853dc45981cc8b63caf4b916a1b1dea107b1be16831cc7bc67d97ce82966a18e54b2b20b8e4814203b864753ef03bb85aff8
SSDEEP 49152:Mml3dsL6VosSzuXA/+ov1XDkmYNVL8zJR7xFJc35AZI28OQsqsj5o5cpdKQK1Kso:Mm1WmpuyiJxi3AK17NTE
TLSH
T18F664A07EC6564E8C1ADD1308AB39562BF71BC494B2127C72BA0F6243F76BD0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
11152	wevtutil.exe
1048	wevtutil.exe
9272	wevtutil.exe
11484	wevtutil.exe
17728	wevtutil.exe
23952	wevtutil.exe
16780	Process not Found
19204	Process not Found
11648	wevtutil.exe
1492	wevtutil.exe
15436	wevtutil.exe
14964	wevtutil.exe
26132	wevtutil.exe
25932	Process not Found
1156	Process not Found
18784	Process not Found
6244	wevtutil.exe
9820	wevtutil.exe
25460	Process not Found
6708	Process not Found
12992	Process not Found
8912	Process not Found
15688	Process not Found
25592	Process not Found
6988	wevtutil.exe
8336	wevtutil.exe
6352	wevtutil.exe
21108	wevtutil.exe
20368	wevtutil.exe
20212	Process not Found
8892	Process not Found
9316	Process not Found
14768	wevtutil.exe
4248	Process not Found
15504	Process not Found
22112	Process not Found
12104	Process not Found
10328	Process not Found
7764	wevtutil.exe
26044	wevtutil.exe
20668	Process not Found
6708	wevtutil.exe
26028	wevtutil.exe
23160	Process not Found
23000	Process not Found
7324	Process not Found
15268	Process not Found
6752	Process not Found
13316	wevtutil.exe
12100	wevtutil.exe
12896	wevtutil.exe
11376	Process not Found
21984	Process not Found
22372	Process not Found
17936	Process not Found
9524	wevtutil.exe
6764	wevtutil.exe
15980	wevtutil.exe
17692	wevtutil.exe
22992	wevtutil.exe
22700	Process not Found
21892	Process not Found
26252	Process not Found
12360	wevtutil.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
24464	Process not Found
26188	Process not Found
11108	powershell.exe
21584	Process not Found
26220	Process not Found
21276	Process not Found
22728	Process not Found
22940	Process not Found
3172	Process not Found
13000	powershell.exe
2012	Process not Found
26556	Process not Found
23840	Process not Found
15796	Process not Found
20884	powershell.exe
6532	Process not Found
11492	Process not Found
2416	Process not Found
12164	Process not Found
22368	Process not Found
17156	Process not Found
20492	Process not Found
19568	Process not Found
18604	Process not Found
4788	powershell.exe
17552	Process not Found
5724	Process not Found
19708	Process not Found
21644	powershell.exe
2688	Process not Found
7616	Process not Found
11556	Process not Found
7044	powershell.exe
20772	powershell.exe
19988	Process not Found
18772	Process not Found
25360	Process not Found
6308	Process not Found
12520	powershell.exe
13620	Process not Found
18480	Process not Found
11612	Process not Found
1640	Process not Found
9604	Process not Found
10516	powershell.exe
22492	Process not Found
1124	Process not Found
17148	Process not Found
26524	Process not Found
9600	Process not Found
12316	powershell.exe
1640	powershell.exe
18688	Process not Found
12404	Process not Found
21364	Process not Found
15924	Process not Found
24424	Process not Found
8616	powershell.exe
20192	powershell.exe
12880	Process not Found
22100	Process not Found
19192	Process not Found
12792	Process not Found
5904	Process not Found

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe	OneDriveSetup.exe

Executes dropped EXE 4 IoCs

pid	Process
1976	OneDriveSetup.exe
1488	OneDriveSetup.exe
1076	OneDriveSetup.exe
5276	OneDriveSetup.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\OneDriveSetup.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsSecurity.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemConfigUpdate = "C:\\ProgramData\\Microsoft\\Windows\\SystemConfig.exe"	reg.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
7956	Process not Found
17668	tasklist.exe
2596	tasklist.exe
8148	tasklist.exe
22328	Process not Found
19668	Process not Found
21896	Process not Found
21364	Process not Found
20224	tasklist.exe
6448	tasklist.exe
10984	tasklist.exe
11720	tasklist.exe
10104	Process not Found
12228	Process not Found
1304	tasklist.exe
8816	Process not Found
26300	Process not Found
12116	Process not Found
17444	Process not Found
13060	Process not Found
9268	tasklist.exe
6916	tasklist.exe
16716	Process not Found
21344	Process not Found
9788	Process not Found
14780	Process not Found
3648	tasklist.exe
10564	tasklist.exe
11260	tasklist.exe
5612	tasklist.exe
9880	Process not Found
11440	tasklist.exe
14512	tasklist.exe
10560	tasklist.exe
26532	tasklist.exe
3304	Process not Found
13536	Process not Found
24088	Process not Found
13140	Process not Found
3476	tasklist.exe
10532	tasklist.exe
952	Process not Found
6660	Process not Found
24364	Process not Found
4748	Process not Found
22576	Process not Found
7316	tasklist.exe
11228	Process not Found
13800	Process not Found
20968	Process not Found
8848	Process not Found
26432	Process not Found
11728	tasklist.exe
16004	tasklist.exe
16076	tasklist.exe
25424	Process not Found
15260	Process not Found
8684	tasklist.exe
11824	tasklist.exe
11196	tasklist.exe
15808	Process not Found
17796	Process not Found
24260	Process not Found
24392	Process not Found

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
7056	reg.exe
18652	reg.exe
21892	reg.exe
12468	Process not Found
8408	reg.exe
2684	reg.exe
6376	reg.exe
10784	reg.exe
24948	reg.exe
17652	Process not Found
17736	Process not Found
10792	Process not Found
4508	reg.exe
4648	reg.exe
6384	reg.exe
12804	reg.exe
24856	reg.exe
11616	Process not Found
22892	Process not Found
2308	reg.exe
7256	reg.exe
9180	reg.exe
12532	reg.exe
12440	reg.exe
18592	reg.exe
5984	reg.exe
24132	reg.exe
8632	reg.exe
7732	reg.exe
3036	reg.exe
11284	reg.exe
24296	reg.exe
15776	Process not Found
15756	Process not Found
1612	Process not Found
4160	reg.exe
11964	reg.exe
14024	reg.exe
21200	reg.exe
12892	Process not Found
21920	Process not Found
23768	Process not Found
14292	reg.exe
13896	reg.exe
10236	reg.exe
18268	reg.exe
23852	reg.exe
18360	reg.exe
24528	reg.exe
23020	reg.exe
3256	reg.exe
7900	reg.exe
10412	reg.exe
14112	reg.exe
13588	reg.exe
9252	reg.exe
18284	Process not Found
20572	Process not Found
8500	reg.exe
12144	reg.exe
12892	reg.exe
9316	reg.exe
25576	Process not Found
17108	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
13464	Process not Found
16892	schtasks.exe
14132	schtasks.exe
19488	schtasks.exe
24656	Process not Found
20500	Process not Found
18980	Process not Found
10700	Process not Found
3280	Process not Found
11020	schtasks.exe
18684	schtasks.exe
25304	Process not Found
25376	Process not Found
25252	Process not Found
16804	Process not Found
25972	Process not Found
20060	schtasks.exe
12232	schtasks.exe
15456	Process not Found
22924	Process not Found
10052	Process not Found
15308	Process not Found
17692	Process not Found
20408	schtasks.exe
21412	Process not Found
16844	schtasks.exe
17672	schtasks.exe
6896	schtasks.exe
25832	Process not Found
26084	Process not Found
16452	Process not Found
9744	Process not Found
1224	schtasks.exe
7096	schtasks.exe
7012	schtasks.exe
26116	schtasks.exe
11548	Process not Found
22540	Process not Found
14308	Process not Found
11168	schtasks.exe
23384	Process not Found
16716	schtasks.exe
16908	schtasks.exe
5848	schtasks.exe
16032	schtasks.exe
21524	schtasks.exe
14652	Process not Found
1640	Process not Found
6652	Process not Found
7096	Process not Found
16892	Process not Found
16744	schtasks.exe
22308	Process not Found
11048	schtasks.exe
17896	schtasks.exe
21768	schtasks.exe
18588	Process not Found
14852	Process not Found
11096	schtasks.exe
11192	schtasks.exe
9400	schtasks.exe
16452	schtasks.exe
26040	Process not Found
11088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5728	powershell.exe
5728	powershell.exe
5728	powershell.exe
5728	powershell.exe
4788	powershell.exe
4788	powershell.exe
3344	powershell.exe
3344	powershell.exe
2748	powershell.exe
2748	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	tasklist.exe
Token: SeDebugPrivilege	4740	tasklist.exe
Token: SeDebugPrivilege	4632	tasklist.exe
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	1304	tasklist.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	4360	tasklist.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 1800	3716	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 3716 wrote to memory of 5728	3716	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 3716 wrote to memory of 4124	3716	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 3716 wrote to memory of 2072	3716	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 3716 wrote to memory of 4160	3716	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 1800 wrote to memory of 4632	1800	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 4124 wrote to memory of 2064	4124	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 2072 wrote to memory of 4740	2072	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 3716 wrote to memory of 3548	3716	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 3716 wrote to memory of 596	3716	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	105
PID 3716 wrote to memory of 252	3716	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	108
PID 4124 wrote to memory of 708	4124	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	110
PID 2072 wrote to memory of 2788	2072	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	111
PID 1800 wrote to memory of 5308	1800	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	112
PID 708 wrote to memory of 2748	708	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	113
PID 2788 wrote to memory of 4788	2788	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	114
PID 2788 wrote to memory of 4240	2788	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	117
PID 2788 wrote to memory of 5488	2788	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	119
PID 5308 wrote to memory of 3344	5308	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	2329
PID 4240 wrote to memory of 1304	4240	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	122
PID 2788 wrote to memory of 4508	2788	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	175
PID 1976 wrote to memory of 4860	1976	OneDriveSetup.exe	125
PID 5488 wrote to memory of 4360	5488	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	126
PID 1976 wrote to memory of 1076	1976	OneDriveSetup.exe	131
PID 1976 wrote to memory of 1488	1976	OneDriveSetup.exe	132
PID 1976 wrote to memory of 5276	1976	OneDriveSetup.exe	133
PID 1976 wrote to memory of 3256	1976	OneDriveSetup.exe	134
PID 708 wrote to memory of 2308	708	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	186
PID 2788 wrote to memory of 428	2788	2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1388
PID 1488 wrote to memory of 1492	1488	OneDriveSetup.exe	985
PID 1076 wrote to memory of 1476	1076	OneDriveSetup.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:1096
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8260
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:15396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:21644
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:23752
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:23852
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:23892
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:24084
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:24460
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:24876
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:11608
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:8452
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:8632
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8444
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:15584
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:22352
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:15264
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:18592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:19476
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:23580
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:24016
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:25712
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6896
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:12124
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9484
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:15648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1640
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:24164
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:24276
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:24404
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:25784
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15032
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:9500
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:11176
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:9300
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:7452
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:15840
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:16900
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:25824
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:15716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:23032
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:936
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:24716
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:24948
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:26328
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:11824
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v UserProfileUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
      4⤵
      Modifies registry key
      PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:1604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:4980
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:19832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:3668
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20004
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11552
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20100
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13036
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:8368
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:13960
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1224
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:19296
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:15456
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:23524
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:25044
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn UserProfileUpdate /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
      4⤵
      PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:4880
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:4692
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:13404
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:21592
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13900
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:14004
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:16076
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11420
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:20224
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:18684
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:20060
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:20364
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:26196
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:20368
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:25004
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:12868
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:12472
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:18188
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:16868
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:20280
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:22992
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:6368
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:6432
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:6620
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:11096
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:11112
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:7684
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      PID:1492
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      Clears Windows event logs
      PID:11484
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:17132
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:11908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:16008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:12208
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:12264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:18872
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:12504
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:12664
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:12864
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:15036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:17728
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:9408
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:9592
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11896
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:23268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5728
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2748
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemConfigUpdate /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      Modifies registry key
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:1876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8132
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:13648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:17624
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:20660
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:21892
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:428
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:22412
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:19632
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:23404
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:21676
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:23976
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:21856
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:20356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:24624
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:6396
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:8228
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:8408
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7520
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:15680
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        Clears Windows event logs
        
        PID:12896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:17924
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:21788
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:22320
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:18036
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:19548
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:21624
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:22968
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:23208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:24380
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15352
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9516
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:14748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:18512
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:24108
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:24260
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:24296
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:24616
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:25492
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:23832
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:21204
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17760
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:10960
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11168
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:8356
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:11892
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:12964
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:26124
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:15892
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:22812
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:23880
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:23948
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:24000
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:5624
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9752
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:13280
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:2912
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13396
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:13816
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:19716
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:14200
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:21796
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17672
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17896
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:20152
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:26264
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:26552
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:5856
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemConfigUpdate /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:2456
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11872
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11916
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11924
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:16004
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:12360
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:12512
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:12804
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16892
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:14544
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:17124
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:18660
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:21188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:25084
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:6244
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:6324
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:6440
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:7348
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:11020
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:11240
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:6872
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:2912
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:16852
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:15800
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:6060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:20012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:13132
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10364
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8784
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:4740
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:12584
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:14240
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:9212
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:14132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:20124
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:26016
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:26092
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:12400
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:25720
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4788
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4788" "2252" "2156" "1984" "0" "0" "1936" "0" "0" "0" "0" "0"
        5⤵
        
        PID:19500
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6728
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:10584
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:11696
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:11260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:11788
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:19048
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:12248
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:12452
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:12440
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:16876
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:12372
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5848
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        8⤵
        
        PID:18612
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        8⤵
        
        PID:25812
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:11724
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7636
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:7104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:13548
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:20620
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:13908
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:13916
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:18572
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:11496
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:12872
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:9256
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:19652
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:20208
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        8⤵
        
        PID:26068
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        Clears Windows event logs
        
        PID:26028
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:25132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:14364
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        8⤵
        
        PID:21356
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:23020
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:25104
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7836
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:8812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:6484
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:20468
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:8708
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:22624
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:4236
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:19512
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        Clears Windows event logs
        
        PID:12100
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:11076
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:26116
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        8⤵
        
        PID:14808
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        
        PID:25244
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:13500
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:7900
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:7996
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:8048
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11192
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:11208
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:11232
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:1048
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:10360
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        Clears Windows event logs
        
        PID:15980
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:23616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7352
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:13080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7632
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:3620
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8412
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:11780
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:11152
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:11964
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16716
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:12176
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:12144
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:12420
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:25336
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5488
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7280
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:12328
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:20092
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:12340
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:20380
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:12348
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:13348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:12384
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:13304
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:10992
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:14112
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:19432
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:14244
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        
        PID:26008
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        
        PID:20324
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:25076
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7288
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:4332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:13668
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:13856
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:18912
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:14328
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:19292
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:10784
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:10024
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:14364
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:1492
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:19488
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:20408
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:26024
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        8⤵
        
        PID:12032
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:18728
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7296
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:2728
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        Discovers running processes
        
        PID:14512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:10492
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:6704
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        9⤵
        
        PID:13572
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:11124
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:11956
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:9224
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:11132
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7012
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:15416
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        8⤵
        
        PID:14652
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        8⤵
        
        PID:9412
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:6368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:23964
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        8⤵
        
        PID:19136
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:21524
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        8⤵
        
        PID:21436
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        8⤵
        
        PID:26076
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:18556
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:7732
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:7916
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:8056
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11048
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:11224
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:3528
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:2216
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:16916
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:16144
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7340
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10920
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:14536
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:13748
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15176
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:8652
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:14048
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:14232
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:9644
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:8368
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:21572
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:13324
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:24568
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemConfigUpdate /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:4604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7460
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:16100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:22788
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:23724
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:23764
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:23864
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:6908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:8348
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:8500
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8404
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:15816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:19604
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        
        PID:24560
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        
        PID:8244
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:23624
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        8⤵
        
        PID:26060
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9492
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:16196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        8⤵
        
        PID:16080
        
        C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        8⤵
        Clears Windows event logs
        
        PID:21108
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        8⤵
        Modifies registry key
        
        PID:18360
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        8⤵
        
        PID:24648
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:11196
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:9508
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:11040
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:8716
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:8460
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:14768
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:16884
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        Clears Windows event logs
        
        PID:14964
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:21420
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:15764
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:17744
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:24788
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:24904
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:24856
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:26164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9588
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemConfigUpdate /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:428
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:6336
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:6412
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:6636
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:11064
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:11152
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:8424
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      PID:7764
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:14964
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:15900
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:12128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:11104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:19580
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10308
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:20036
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:12672
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:12812
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:12892
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:3016
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:18024
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:16400
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11972
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:24920
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetupUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4160
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn OneDriveSetupUpdate /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:3548
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsSecurityUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
  2⤵
  - Adds Run key to start application
  PID:596
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsSecurityUpdate /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:252
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v UserProfileUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
  2⤵
  PID:4212
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn UserProfileUpdate /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  PID:6132
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
  2⤵
  - Modifies registry key
  PID:6384
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:6464
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:6688
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:10356
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7096
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_977856f47060b0eec6b790e7586b30a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:9696
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:4472
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:16788
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:14264
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:26108

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:6520
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:7404
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17564
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:11312
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:11588
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:19468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:11632
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:9892
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:9232
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:10412
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:13212
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:11892
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16744
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:26044
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:2800
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:11440
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:22200
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:26484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:6744
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:6848
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:11224
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:6912
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:7892
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:10964
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17404
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:10296
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:10048
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:9792
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:16868
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        Clears Windows event logs
        
        PID:6708
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:9388
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:26132
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:19076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:18404
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:26444
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:7056
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:5992
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:8064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:13364
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9308
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:13444
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:13684
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        7⤵
        
        PID:23272
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:9252
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:11548
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:9272
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14112
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:9892
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:3744
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:6856
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10904
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:11088
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:9336
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:4648
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:6612
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:15832
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:20432
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:6344
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:1268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:260
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:6504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:16828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:6880
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17888
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:9448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13796
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:8876
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:12144
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:5992
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:16860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:16556
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:20376
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:24732
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:22404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:25164
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:2984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:3536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:8160
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:19824
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:26532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:12616
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:26460
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:10236
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:9936
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17748
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:11648
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:7096
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:26360
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20192
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:4756
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:21488
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13424
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:4220
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      PID:6248
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:1040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:20388
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:26436
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:19880
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:19228
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:26476
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:18652
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:15044
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:26468
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:2980
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:15244
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20028
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:14184
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10948
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:17240
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:26452
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:18584
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:9416
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:16860
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:15224
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:15968
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:20496
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:6600
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:18960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11028
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:8336
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:5632
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:6276
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:4824
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:15908
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:20184
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:10028
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:7316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:9672
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7480
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:9268
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:23484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:8816
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:5384
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8484
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:10588
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:18480
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:11284
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:11292
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:11272
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:16844
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:3172
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:12612
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:26404
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:12028
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11448
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:22196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:12520
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:26500
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  - Executes dropped EXE
  PID:5276
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:2596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:2308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:6800
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:6988
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:7272
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:7256
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7808
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:8684
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:14144
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:3036
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:6572
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:9208
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:20700
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:14872
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:12576
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:6764
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:20392
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:13496
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:25588
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10256
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:12744
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:22564
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:16472
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:22840
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:15944
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:23176
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:14024
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:17612
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:17692
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20884
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:22608
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:15804
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11168
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:6328
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:12736
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:26492
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:6460
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:14372
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:9820
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:9316
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:9696
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:12568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:25708
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:20604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6672
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:4580
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:6536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      PID:9820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:6616
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:15752
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:20176
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:12104
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7304
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:4452
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:9668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8616
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9852
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:9844
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:18500
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:3036
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:4848
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:4324
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:14032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:19448
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:12232
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:24128
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10140
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:9768
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v UserProfileUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
  2⤵
  - Modifies registry key
  PID:3256
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn UserProfileUpdate /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  PID:5800
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
  2⤵
  - Modifies registry key
  PID:6376
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:6480
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:6700
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:11056
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:11144
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  - Clears Windows event logs
  PID:6352
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:9388
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:15436
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:19420
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:26100

C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
1⤵
PID:1312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:4560
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:1880
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:6904
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:8504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13616
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:9112
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      PID:7888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:11156
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:14472
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:11644
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:16032
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:19092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:16120
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7244
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:15860
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:26252
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:5164
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:6192
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:9800
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:10352
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11324
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:19056
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:8740
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:12300
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      PID:9848
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:16320
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:8052
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:9792
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:24456
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11564
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:2000
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11740
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:4212
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:6896
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:6932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:11616
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:19060
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11836
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:18676
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11020
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:9832
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:6560
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      Modifies registry key
      PID:12532
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:16908
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:15508
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:16452
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:25992
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:21352
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:12028
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:22216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:17684
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:14692
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:23508
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      PID:10096
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:23952
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:21768
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13588
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
  2⤵
  PID:2596
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:6300
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:4412
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:6776
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:11012
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:6304
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:7692
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:16024
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:20144

C:\ProgramData\Microsoft\Windows\SystemConfig.exe
C:\ProgramData\Microsoft\Windows\SystemConfig.exe
1⤵
PID:2556
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:9056
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10196
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:1832
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:20756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:24100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:20772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:20852
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:20888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15440
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      PID:21052
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:20992
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:20200
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:21060
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:20840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:15488
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:21664
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:9116
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
  2⤵
  - Modifies registry key
  PID:9180
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:7896
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:9460
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:9452
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10528
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:10832
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:23008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:23308
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:19976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:25984
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:16992
    - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
        
        C:\ProgramData\Microsoft\Windows\SystemConfig.exe
        5⤵
        
        PID:23744
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      Modifies registry key
      PID:5984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:23680
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:23772
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:23516
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:20416
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:9688
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8412
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:8888
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:23788
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:23172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:23932
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:24348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:25392
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:24356
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6996
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      Modifies registry key
      PID:24528
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:24536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:23664
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10688
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:10044
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:6532
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:14036
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:15972
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:21852
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:12460

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
1⤵
PID:2736
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:9124
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8728
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:6972
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:21244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:21292
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:17680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17584
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:18192
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:18096
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
      4⤵
      Modifies registry key
      PID:18268
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:18892
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:17244
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:21820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:9196
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:8396
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
  2⤵
  - Modifies registry key
  PID:2684
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:9468
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:10532
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:6648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:21044
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:20912
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
        5⤵
        
        PID:13164
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:21160
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14520
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
      4⤵
      Modifies registry key
      PID:21200
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:21208
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:21132
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:17668
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:21272
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
      4⤵
      PID:16692
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:20084
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:17160
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:9476
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:9680
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7940
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:14820
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:23712
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:18880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:23816
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
      4⤵
      Modifies registry key
      PID:24132
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:24036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:26084
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:24140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:24328
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:24044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:22904
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:12276
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:6948
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9400
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:13596
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  - Clears Windows event logs
  PID:13316
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:19796
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:26180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
PID:6960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3timxelf.5l1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3timxelf.5l1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 769a7630f73b5fea328d7d62f89f231496bec6901339df3d103e748d25abf894
MD5 15787193c1687498820e23d7086d7b88
SHA1 6d4252bd7f579fff051ca6fdf37c259d7f588491
SHA512 6b2168fc7b93df0f9a9b4d88c66bc817de5d1f0726f6fa977c4dc5826afd74c2a5638c292929d1571b6dbc29f471197dffb24567dd3e16fda22f9ce16a325e2d
TLSH
T14190028A13744D007A194087C4E147252011BD44098987D08299614D306682A1407914
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 9dfd0ad78a50861a2fda709d6c43026653d5dfd270b6e28be29a3e60a99ed54c
MD5 8121aec0b21d3284ad70a7a77f3f8e45
SHA1 181718107b401bc758ae5017a06e3ef927adaab9
SHA512 413cff35b3fbf3a70c74fb0d06ed6d95ce9f2e69e0f56db84566560ba5dfc2e4d85b3d126b9711b72d2110c4c3f7d7299b3e8366a419a49518f6635a05d46ac8
TLSH
T12D90028A53744D007A194187CCA557252001BD44098987C08295645D302282A1407918
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 670dae70e21e5f6a39069cc87d0f291fa1cb43f8346326974cbab2539607388d
MD5 0ab5f7247607293fcbb8df4950640e51
SHA1 a2cbd6b37feb33e1ff6f5e0ebc4cee827ff55166
SHA512 1fea4e16c382fd601f95b838ceb17c562b17691da9510936f3d8864124729c69c5f10d5bac104d1686eef15acd8790ee5fa649c3d7de13d47bcb4d9f5d3b0ec8
TLSH
T1AB90028A1374490079194097C4E257265001BD4509898BC08299600D303282A1407A14
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 83761218457bc55047789d78402d689d4216baf95641af77d3f9908b35223242
MD5 e4f4f76cd8319ff4f799735ec12a3495
SHA1 cb137132d7c8f244fcac1976633d74597be6c98a
SHA512 f992011a6a3f0a0bab339bced88c71370ac364b509d24649fd1e2ed122f087f33cb8b1e01810669e9bfd066a91d01c5819c16679bfedf2e8c9a1a737746c51c1
TLSH
T1DE9002CA1374490079194097C4E257261001BD44098987C08299600D306282A5407914
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 a199d7ed987196fb15ee826e9ab43e5f300ab53015db0e63bb61ca00802a667d
MD5 ab6c01779d2806e7f64e77495cca44b1
SHA1 f07fcab3c5489bc683fb1faffb0c3bddb899311b
SHA512 aa85e654adfbedffafcbd190c7aab1f4c52e818f0319230c035dfaedba9ab7d2e69ccec4e20151517c70960fa2331ce273f0993ac42ec3c9727cb2d1a99aec1c
TLSH
T1F390028A53744900B9194197C4A267261001BD44098987C08295641D302283A1407918
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 173d9c6fffa3f0649a73bcab2c323274865fbb2caabb798c0ef3df5841812e36
MD5 8084dc67ab0be017b70241d2a6a4ab16
SHA1 bffc62ae24bf913fd861500ecd5121fcdff68430
SHA512 eefc57192451fa047929cdc281419bd412cfb623e2c4813fa761ab4a8b2b46579a776bf35dcb42bf3b80c0b8ee1dca090aae812871b64a65a2bcb038b51e4047
TLSH
T14090028B1374490479294487C4A147251001BD45499987C08395600D303382A1807914
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 ce99053ba22197e71518369721463af9d4f21fb45dfdb491996b41bbda1e6523
MD5 66b03ff001559d765001a9231ec32418
SHA1 9ceded9f37150e08a8d0d664e274fe60bb7d67a2
SHA512 764bb0e0fe3619071383a37662fb876fb31f133f63130afb982b1ceaf05b227b0eb5a16c782b0572323286aa2ad3606264b30fbaefdfd67b250aaebff7639128
TLSH
T19390028A1774498479294087C4A147251001BD45098987C1C295600D302382E1807914
MD5 SHA1 SHA512 TLSH

Submit Download

kl.dat

Path C:\Users\Admin\AppData\Local\Temp\kl.dat
Size 52B
SHA256 e7879a6fd62407ed2d8839556c2b20ec24d7d3fd5243cecc0ea0415c367d551d
MD5 e656ee07c0b5aaa3c086d3fbecac5c6f
SHA1 96dc41c4343b196209b4f97ffc90c6ffae3f1db9
SHA512 fa32a73921c9415978ef8a5dce4da1cfa4e11a58f04003d06bd4fb7ad84a3da191f91331cb829263e7f77f62ce6e8249a6cb0714d75a9f5e4cd735064da434c7
TLSH
T17D90028A13744D007A194087C4E147252001BD5509898BC08299604D303282A1407A14
MD5 SHA1 SHA512 TLSH

Submit Download

watchdog_task.xml

Path C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml
Size 1KB
SHA256 d8ed39f0b3d797c37a62fba2188118a4e1d785136f5fb97cb5a0f76998a2869d
MD5 0120475740381c0b05612d4f1da6aa24
SHA1 f6b3d38a083bba7743275146bce923da085a045e
SHA512 b8be967d836d8225cfed572dbcdd560bf3e3e52807dea515dbe196c87b681e9167e71edeaf89260de3cd404a78c8568040b8dc11b0b996ab206e83a17b48dfe0
TLSH
T14B31DD64A9F0B36BFA534539C25166421F65977381134134F9CC4E7C7FCEA8AA14362B
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
Size 6.6MB
SHA256 704db39eaee2ba746ddcbb8190e51c56ba91e70887aadf27b2c104c34b9d181d
MD5 977856f47060b0eec6b790e7586b30a4
SHA1 213bcec01fb77879d94f84bf449760d3510a9bc8
SHA512 177706e01723caaa5669353931bb853dc45981cc8b63caf4b916a1b1dea107b1be16831cc7bc67d97ce82966a18e54b2b20b8e4814203b864753ef03bb85aff8
SSDEEP 49152:Mml3dsL6VosSzuXA/+ov1XDkmYNVL8zJR7xFJc35AZI28OQsqsj5o5cpdKQK1Kso:Mm1WmpuyiJxi3AK17NTE
TLSH
T18F664A07EC6564E8C1ADD1308AB39562BF71BC494B2127C72BA0F6243F76BD0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserProfile.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
Size 64KB
SHA256 4d310f4c29716f66d661657c89e28208402e5b5c2660039d876993c644889cc0
MD5 2bad163c4f54e21421ec55b9b37f836f
SHA1 76ef8045f82ceccac2e432dfbad6a033941eaab1
SHA512 e5658012322e62f08a8e29d52e885990cc1687e559275ee822820a9be83423c187ff7d600d1d44fbddbbf1f0ce3e7cdaa4ec9dc786d9a73ec11ceba189aa2037
SSDEEP 1536:MQJ+3VtEKAVWbaxLL2VZqCJ9T5oNWOklCyHhi77jFFnWMGi:Mp/EKkWbXRPREgQ7f
TLSH
T1EE53D55B9C9810E8C4AED078CB37A6477F62708017A06BE72D716AA10F17FF5A1F9B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.id

Path C:\Users\Public\agent.id
Size 16B
SHA256 c222857fc0dbb6c4b6c4844d6e51a50c2d068926895f29047d315a1cf10d47d0
MD5 8c2c96ea97a44f3f2750c3b6a97327a3
SHA1 1b1c2ed06bc209d91583ee6c155faacce80ddfae
SHA512 e5c063dcc9489fc8c26e9176a727a1a2a768f7f286458407f570ab790f1921c4da5ad6a19ff7c6cd6088fcb231d8d57febd015c22abe158aecc099a72faeca7b
MD5 SHA1 SHA512

Submit Download

debug.txt

Path C:\Users\Public\debug.txt
Size 33B
SHA256 dc342b3f1f113035a18ffe23c1209a6331d769b998cdc28d5db21af6ea5887fe
MD5 82d4cf254f2f370a54c42c149003ec28
SHA1 49baaddf5f7808380439d57a641a392a72827a63
SHA512 402f612108d1641b2662d505e7a6d66836536ec74224eecdedb6693dbf4518d0d96739d1bbf6a3f0e9a1ec8c1b4cf68784a90e9afa11c730d57fe8ccb6045bd9
MD5 SHA1 SHA512

Submit Download

debug_error.txt

Path C:\Users\Public\debug_error.txt
Size 133B
SHA256 293da7750ce0bd2bc2d12add12d27b2a4354115feb4d15fb73e713fe4c4d1868
MD5 606c14c1794af1d1c9790060db10f9a6
SHA1 00146d4745bcf92069c6db8d7dcfb3d81149700c
SHA512 2eaccd5aba6da945853308b7c13a4c433276f3472d1a217cf00e3dae5f7a5b36d01e2ab637335bdd7a2f4a22ee33c1bcac02b59a5b047958f2d7b10c5f631b9a
TLSH
T139C02B919A132023AE0082C1412268C7312B002D0F41C07191EC800DF9810D4D02DF00
MD5 SHA1 SHA512 TLSH

Submit Download

protect_success.txt

Path C:\Users\Public\protect_success.txt
Size 51B
SHA256 320b9defc1854e7a0388f9ff2c7ad83a6a4c21206078a824d39fc8e76b5f54f9
MD5 66c5ce98e7c980a32c62fdb9715f66f6
SHA1 cedd445ca46850a4b985641495f12759e9a2a921
SHA512 46175c6cad063a9a2180f58017e228e64829344a3c1885805aea1275f1a1a6549d91a174102ebe310cc36582dde45336274b5108a0f62bbe507facde0ff87017
TLSH
T1EC900281104696054596899751814B67E89E74041479A19014D45746854520542066D6
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 423B
SHA256 22edf3aecb92dc422c96bc35bc6fd66c091b1d92bedfde4d3ef3e08d7cce7109
MD5 6768a1a518f535af4506a73e29df8daa
SHA1 2e5aafe552bb1cc1e80cfbd60f961a326bdec9ef
SHA512 c2cd05eae10033b883a9ba635a0f11253755d0d945e659cf326a4048b180b26034982b974607304044b8b95a2d3bdfe190ae3d12f73c423782c24f966934bee2
TLSH
T17EE0AB00D27648528202B727A0E4A62FAC0C203D53450B05DA3D89CE2F5086B8704207
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 423B
SHA256 7641b919936227d19967f09c4c03437f6b97d6841a8ffd820739ff68629dd85c
MD5 1b607465e01b29b1c8acce048216b219
SHA1 babe862b4c639f65c25329ff132f1c51dd4984c9
SHA512 336874b5d2627a53057e98e58655733007c423ebf5dbcd1c6058182e34a810318f2f44c749e407e17dafd69837d3f198fa43eab54afc9cd8dba3d03fa34d2b5e
TLSH
T14DE02205D6B54C57C713FB36A4F6363AAE1D502E030A0B05AD7E55AD7F009A7CA4D253
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 355B
SHA256 53f8a8ab7879e7372493593727408f393795325282d479cf361bbcc947022028
MD5 ab28e31e06092cceab02104213b5ff98
SHA1 21c0712ae3690e807fdac6412d48cbc76caa8a89
SHA512 ebefa972671220136c697eab0528144088d674481554a34088885a163492698bf1fa463dfab9bb3a700f95f2c912ab53deac02d1137dcdee2bd6a1e0546bf8fa
TLSH
T130E02605D6B98856C213BB3674F6762ABD5C102E030A0B05ED7D559D3F449ABC749143
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 381B
SHA256 afe97ea34d6592ede01244c9225a0edd6256d96c36a3550e25cb24ac8c562c3e
MD5 8ab012810a080ccd5bcb4e2377418cfe
SHA1 079af5bd8ef369ce46cffe83d66a75c317767ef1
SHA512 2def73314877d521710cba13b7b094b37ac83b70a06e546789723c2281726b14fbbe205f9d707b91ef9e896ac49ed4c48118368211df8000ccdca1ba9c9dfb3f
TLSH
T1F2E06801D2B84453C213BB3234E5772ABC8C402E130A0B11A92D459E6F04857C648103
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 338B
SHA256 c3ed367e1a437ca4030c2322b8f49943e682f874a700b4e7240806ab0e7ba4c7
MD5 804c07c5a0e778f3a49f24b3d0088f4f
SHA1 04121a3f9b51917869dd3575a7b1e0a382c6952c
SHA512 2bec80c8481781c760011b73e3acfd81007abf77db6071c234d732e4e0b16f917065360d4365c8628c448780513d52398b5e91d1947eb0f0309d130f2a82f5b7
TLSH
T14AE02601D2754462C212BB3574E57626FD0C502E030A0B25A87D429E6F049678718607
MD5 SHA1 SHA512 TLSH

Submit Download

self_monitor.ps1

Path C:\Users\Public\self_monitor.ps1
Size 342B
SHA256 9207ff7650394ede8eaee1254609eda60865af9aacf3c5269ba7f52a5e0db528
MD5 7dfaa8a0ac44fdaa247063f5a7b0be10
SHA1 72e41b9eec6adf23c8005ddfe3dc4c3da32bc18d
SHA512 7deca68841436d783c6efb8369ce23dd4dd3eebc830cff6f4830226cc1882c4dc9d33fc5e865b0cd0cf43adfe9a73296410035c0b67e539b374f0023bf8df7e7
TLSH
T11AE02601D2BA48628202BB3674F5732AFD1C002D130A0B10EE3D859D7F0486B8749203
MD5 SHA1 SHA512 TLSH

Submit Download

stub_watchdog.ps1

Path C:\Users\Public\stub_watchdog.ps1
Size 285B
SHA256 14d2e7a7ebefb76a5466318e2be7bd5849d1792c4d9a042cab3b7cd56cbadc10
MD5 d8c5396c15cea00f59e58c152faba597
SHA1 38f85d423f3379313a8c3206a4f7e73a8f1edcf2
SHA512 5e03ba1da6e084336a0daaee5e48b35a73ee675f923e43ae2fae2468a8c80dcd8c624858649ac9d44f57880cf1c8a3d30ed61dc03249f6685cbc12ebcb415594
TLSH
T197D0C200D26A45428101B72A74A5B36FFC5D042C03061724C93E849D3F0485BC749252
MD5 SHA1 SHA512 TLSH

Submit Download

stub_watchdog.ps1

Path C:\Users\Public\stub_watchdog.ps1
Size 366B
SHA256 ec270702a81d61fbd468ce9e40beac83bd9debe8bc7f51ed35098c48a02460ae
MD5 f6bb56782cb4f6d2defe7f2b127bd39a
SHA1 4278341793a7422ed16ee8d736696703b8cb6100
SHA512 dd104a552e1b400493ba96f3431a873b0a98cd296c275afe68b38701c422b2982d96c7206bb9b1e6831a0162882e4b4924bb4083fcfca15533bdc8cbd4252980
TLSH
T178E0DF00922689468206A72AA5E5AB2FEC4D247D53454759CA3E998E2F6086BD748216
MD5 SHA1 SHA512 TLSH

Submit Download

stub_watchdog.ps1

Path C:\Users\Public\stub_watchdog.ps1
Size 298B
SHA256 46e93e01dba6bd4c798ccce289d64c3cf0e05394f29a74fb4317e0e6ea1ec2c6
MD5 8df52e664562a697e4673005f43104dd
SHA1 e1fdb85bfde9894824fecc5aefa638e65a7a06c7
SHA512 2b0126078831c0f09996bcd1985ccdc2537af6d56d8ce594b48a4d0af34e413aa561b3c6ba6c8092c2cbd9c29f7da4f73f16ad2f506b8e61cae1bd9a486a1239
TLSH
T11DE0C204D26A8946C212A72AB4B6772BFD5D042D03051715C97E989D3F4489BD759152
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 64KB
SHA256 a5e82c0d37c2f8f1759aff3d7370a33c0e5f55d07ea060b1fa42d0eb2a9b856d
MD5 fcff1a4d9bbcc32857e8e6438307505e
SHA1 48eef92dd4467632df40fee8d0d505333c79a5f8
SHA512 a0ba18de4afa9c7445c2a54b717037629f8d163de63466ee20a839b32651a64c103d27ac54cc580601ec58aca8437ad78aa9b84c1f263eb5e83eb0ba1ca8e407
SSDEEP 1536:Zq6gfLjhqzuRskDV7u2a9ZhD1lmD5Dv1PPJ/C7PMV57bUzqShFPXCF3traGFQm7h:ioqH
TLSH
T18B532E0580D8C619C5B60BA273ABEF72D92E6586770B0DE531AD7301D8C2B552F7A0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-597-0x00007FF660990000-0x00007FF663086000-memory.dmp

Download

memory/2308-1143-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/2968-932-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/2984-1142-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/3716-1282-0x00007FF82C790000-0x00007FF82C7B7000-memory.dmp

Download

memory/3716-927-0x00007FF82D420000-0x00007FF82D4D2000-memory.dmp

Download

memory/3716-1096-0x00007FF643660000-0x00007FF645D56000-memory.dmp

Download

memory/4788-762-0x00007FF82B550000-0x00007FF82B588000-memory.dmp

Download

memory/5728-9-0x00000214B3F50000-0x00000214B3F72000-memory.dmp

Download

memory/5728-1053-0x00007FF823950000-0x00007FF82396E000-memory.dmp

Download

memory/5728-824-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/5820-1140-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/6908-784-0x00007FF749FC0000-0x00007FF749FDE000-memory.dmp

Download

memory/6960-434-0x0000029800050000-0x0000029800098000-memory.dmp

Download

memory/7028-1080-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/7600-1000-0x00007FF82F380000-0x00007FF82F5E3000-memory.dmp

Download

memory/10024-857-0x00007FF6E9110000-0x00007FF6E914E000-memory.dmp

Download

memory/10316-1144-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/10764-1141-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/10992-851-0x00007FF660990000-0x00007FF663086000-memory.dmp

Download

memory/11548-870-0x00007FF6E9110000-0x00007FF6E914E000-memory.dmp

Download

memory/11616-869-0x00007FF707560000-0x00007FF7075BB000-memory.dmp

Download

memory/11728-785-0x00007FF749FC0000-0x00007FF749FDE000-memory.dmp

Download

memory/12984-1348-0x000001423AE40000-0x000001423AE5E000-memory.dmp

Download

memory/12984-1373-0x000001423B100000-0x000001423B1B2000-memory.dmp

Download

memory/12984-1440-0x000001423AEA0000-0x000001423AEBE000-memory.dmp

Download

memory/13096-859-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/13156-1269-0x00007FF82B5F0000-0x00007FF82B60A000-memory.dmp

Download

memory/13588-944-0x00007FF749FC0000-0x00007FF749FDE000-memory.dmp

Download

memory/13648-1127-0x00007FF643660000-0x00007FF645D56000-memory.dmp

Download

memory/14872-865-0x00007FF6E9110000-0x00007FF6E914E000-memory.dmp

Download

memory/15688-999-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/15892-668-0x00007FF643660000-0x00007FF645D56000-memory.dmp

Download

memory/15908-585-0x00007FF82DB90000-0x00007FF82DC57000-memory.dmp

Download

memory/16452-1222-0x00007FF6E9110000-0x00007FF6E914E000-memory.dmp

Download

memory/17604-874-0x00007FF643660000-0x00007FF645D56000-memory.dmp

Download

memory/17652-872-0x00007FF707560000-0x00007FF7075BB000-memory.dmp

Download

memory/19288-947-0x00007FF82F380000-0x00007FF82F5E3000-memory.dmp

Download

memory/19760-866-0x00007FF6E9110000-0x00007FF6E914E000-memory.dmp

Download

memory/20084-864-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/20104-853-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/20184-565-0x00007FF82D5D0000-0x00007FF82D5FF000-memory.dmp

Download

memory/20740-852-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/20844-963-0x00007FF82F380000-0x00007FF82F5E3000-memory.dmp

Download

memory/20932-1138-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/21188-842-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/21888-961-0x00007FF82F380000-0x00007FF82F5E3000-memory.dmp

Download

memory/22124-960-0x00007FF82F380000-0x00007FF82F5E3000-memory.dmp

Download

memory/22536-1095-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/22712-860-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/23032-867-0x00007FF656D40000-0x00007FF656DAF000-memory.dmp

Download

memory/23160-854-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/23184-873-0x00007FF643660000-0x00007FF645D56000-memory.dmp

Download

memory/23252-1248-0x00007FF6BFEE0000-0x00007FF6C25D6000-memory.dmp

Download

memory/23544-861-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/23760-855-0x00007FF6E9110000-0x00007FF6E914E000-memory.dmp

Download

memory/24132-856-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/24952-962-0x00007FF82F380000-0x00007FF82F5E3000-memory.dmp

Download

memory/25104-863-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/25132-1126-0x00007FF643660000-0x00007FF645D56000-memory.dmp

Download

memory/25180-875-0x00007FF643660000-0x00007FF645D56000-memory.dmp

Download

memory/25348-858-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/25576-871-0x00007FF707560000-0x00007FF7075BB000-memory.dmp

Download

memory/25720-662-0x00007FF643660000-0x00007FF645D56000-memory.dmp

Download

memory/26076-862-0x00007FF669600000-0x00007FF669649000-memory.dmp

Download

memory/26148-868-0x00007FF656D40000-0x00007FF656DAF000-memory.dmp

Download

memory/26184-1287-0x00007FF65E4A0000-0x00007FF660B96000-memory.dmp

Download

memory/26500-744-0x00007FF82F380000-0x00007FF82F5E3000-memory.dmp

Download