dac130f05ff225340b4990da457e0fb65df630316cac3416795561beb729027f

persistence privilege_escalation

pid	Process
3560	chrome.exe
12156	chrome.exe
23524	Process not Found
18392	Process not Found
17188	Process not Found
4248	chrome.exe
5484	chrome.exe
2888	chrome.exe
2420	chrome.exe
4392	chrome.exe
16956	chrome.exe
1224	chrome.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Executes dropped EXE 5 IoCs

pid	Process
5960	OneDriveSetup.exe
4456	OneDriveSetup.exe
5348	OneDriveSetup.exe
1816	OneDriveSetup.exe
2344	WindowsSecurity.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\OneDriveSetup.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsSecurity.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemConfigUpdate = "C:\\ProgramData\\Microsoft\\Windows\\SystemConfig.exe"	reg.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
16652	tasklist.exe
7140	tasklist.exe
16552	tasklist.exe
21196	Process not Found
9968	Process not Found
1216	Process not Found
19232	Process not Found
10596	Process not Found
12756	Process not Found
3312	Process not Found
20988	Process not Found
7060	Process not Found
2180	tasklist.exe
13052	Process not Found
16048	Process not Found
12692	tasklist.exe
11216	tasklist.exe
8212	tasklist.exe
15652	tasklist.exe
5600	Process not Found
16544	Process not Found
18200	Process not Found
5592	Process not Found
10024	tasklist.exe
11304	tasklist.exe
18756	tasklist.exe
19056	Process not Found
18136	Process not Found
14500	Process not Found
16180	tasklist.exe
8252	Process not Found
9240	Process not Found
5848	Process not Found
23840	Process not Found
3360	Process not Found
10312	Process not Found
7868	tasklist.exe
15380	Process not Found
12196	Process not Found
20360	Process not Found
19348	Process not Found
7608	Process not Found
21540	Process not Found
15756	Process not Found
6652	Process not Found
21356	Process not Found
15820	Process not Found
19656	tasklist.exe
17952	tasklist.exe
13264	tasklist.exe
11164	tasklist.exe
7352	Process not Found
21492	Process not Found
14688	Process not Found
2384	Process not Found
22972	Process not Found
25116	Process not Found
4848	tasklist.exe
8196	tasklist.exe
17768	Process not Found
19816	Process not Found
20292	Process not Found
9676	tasklist.exe
12632	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\notepad.exe:rat.exe	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5456	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
20644	Process not Found
13976	Process not Found
6828	Process not Found
9056	reg.exe
18000	Process not Found
2472	Process not Found
15908	reg.exe
21136	reg.exe
13568	reg.exe
10580	Process not Found
5276	Process not Found
7208	Process not Found
21388	reg.exe
17084	Process not Found
10596	Process not Found
7272	Process not Found
7648	reg.exe
8240	reg.exe
10968	reg.exe
6648	reg.exe
7096	reg.exe
4848	reg.exe
8664	reg.exe
13744	Process not Found
13068	Process not Found
5928	reg.exe
15028	reg.exe
15284	reg.exe
10124	Process not Found
8504	Process not Found
15896	Process not Found
4792	reg.exe
5332	reg.exe
10508	reg.exe
13288	reg.exe
24072	Process not Found
14420	Process not Found
15148	Process not Found
1576	reg.exe
7096	reg.exe
16304	reg.exe
18920	Process not Found
14780	reg.exe
24112	Process not Found
11560	reg.exe
20800	reg.exe
21240	Process not Found
9696	reg.exe
11588	reg.exe
18680	reg.exe
20848	reg.exe
12992	reg.exe
21512	Process not Found
18276	Process not Found
7296	Process not Found
15404	reg.exe
20792	reg.exe
13740	reg.exe
13532	Process not Found
5972	Process not Found
13532	reg.exe
20868	reg.exe
1636	Process not Found
26340	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
20640	Process not Found
27396	Process not Found
2860	schtasks.exe
13844	schtasks.exe
18872	Process not Found
14352	Process not Found
13512	Process not Found
20552	Process not Found
3360	Process not Found
6808	schtasks.exe
8532	schtasks.exe
12416	schtasks.exe
12540	schtasks.exe
5328	schtasks.exe
20596	Process not Found
12520	Process not Found
8072	Process not Found
8588	schtasks.exe
16336	schtasks.exe
14624	Process not Found
25704	Process not Found
3700	Process not Found
22756	Process not Found
12628	Process not Found
22476	Process not Found
6332	schtasks.exe
14176	schtasks.exe
10560	schtasks.exe
11444	Process not Found
20764	Process not Found
6956	schtasks.exe
12696	schtasks.exe
16292	schtasks.exe
14180	schtasks.exe
19852	schtasks.exe
11364	Process not Found
27484	Process not Found
23432	Process not Found
11076	schtasks.exe
15548	schtasks.exe
22732	schtasks.exe
17032	Process not Found
7240	Process not Found
7428	Process not Found
6084	schtasks.exe
19348	schtasks.exe
16360	Process not Found
7860	schtasks.exe
8048	schtasks.exe
10992	schtasks.exe
11320	schtasks.exe
21240	schtasks.exe
26776	Process not Found
9104	Process not Found
18544	Process not Found
7404	schtasks.exe
9468	schtasks.exe
23784	Process not Found
5972	Process not Found
13308	Process not Found
25256	Process not Found
23032	Process not Found
26096	Process not Found
7764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4248	chrome.exe
4248	chrome.exe
4128	powershell.exe
4128	powershell.exe
480	powershell.exe
480	powershell.exe
480	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	2180	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	6012	tasklist.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeDebugPrivilege	4848	tasklist.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	2804	tasklist.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4248	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1576	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 2612 wrote to memory of 2828	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 2612 wrote to memory of 3296	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 2612 wrote to memory of 4128	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 2612 wrote to memory of 3620	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 2612 wrote to memory of 4248	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4248 wrote to memory of 4144	4248	chrome.exe	98
PID 3296 wrote to memory of 2180	3296	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	99
PID 2828 wrote to memory of 2404	2828	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	158
PID 3620 wrote to memory of 6012	3620	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 2612 wrote to memory of 5832	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 4248 wrote to memory of 5936	4248	chrome.exe	107
PID 4248 wrote to memory of 5456	4248	chrome.exe	108
PID 4248 wrote to memory of 2816	4248	chrome.exe	109
PID 4248 wrote to memory of 4392	4248	chrome.exe	111
PID 4248 wrote to memory of 1224	4248	chrome.exe	112
PID 4248 wrote to memory of 2420	4248	chrome.exe	114
PID 4248 wrote to memory of 5484	4248	chrome.exe	2225
PID 4248 wrote to memory of 3560	4248	chrome.exe	2445
PID 2612 wrote to memory of 4692	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	113
PID 4248 wrote to memory of 2888	4248	chrome.exe	118
PID 2612 wrote to memory of 5876	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	120
PID 4248 wrote to memory of 5076	4248	chrome.exe	121
PID 5960 wrote to memory of 480	5960	OneDriveSetup.exe	124
PID 5960 wrote to memory of 5348	5960	OneDriveSetup.exe	127
PID 5960 wrote to memory of 4456	5960	OneDriveSetup.exe	125
PID 4456 wrote to memory of 4848	4456	OneDriveSetup.exe	2476
PID 5348 wrote to memory of 3104	5348	OneDriveSetup.exe	131
PID 5960 wrote to memory of 1816	5960	OneDriveSetup.exe	128
PID 5960 wrote to memory of 5928	5960	OneDriveSetup.exe	460
PID 1816 wrote to memory of 2804	1816	OneDriveSetup.exe	135
PID 2612 wrote to memory of 4792	2612	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	137
PID 3620 wrote to memory of 5464	3620	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	140
PID 5960 wrote to memory of 940	5960	OneDriveSetup.exe	2784
PID 3296 wrote to memory of 3856	3296	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	142
PID 2828 wrote to memory of 6000	2828	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	143
PID 5464 wrote to memory of 1828	5464	2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetupUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:3856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:6288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11476
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:2960
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:13700
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:13748
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13824
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:13960
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:15680
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:13844
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:1156
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:18944
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:19972
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:23132
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:11200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20744
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:22308
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:22316
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:20328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:21596
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:18188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:10696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:6352
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7440
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:6320
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:13300
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:12536
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:13320
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:15304
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:13760
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9468
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:12928
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:19796
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        Clears Windows event logs
        
        PID:21708
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:10868
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:18600
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:18576
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:20128
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:19868
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:16596
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:20520
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:19532
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:21672
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:22732
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:12644
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9332
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:6432
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7848
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:15436
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:15636
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:15684
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:15780
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:19400
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:17300
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:11412
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:12272
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:13956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:17492
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:11368
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:16312
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17456
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:6524
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:6704
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:6648
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:8000
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:8212
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8532
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:7116
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:9136
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:9456
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:8384
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7112
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:11332
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:7164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14328
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:7516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:7696
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17652
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:23152
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:11164
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:10272
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:10952
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:10992
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:11076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:7544
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:10848
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:11060
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:9496
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7232
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:11884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:13692
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "13692" "1900" "1840" "1916" "0" "0" "1924" "0" "0" "0" "0" "0"
        5⤵
        
        PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:12824
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:14452
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:14464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:14508
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:1464
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:14180
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:17524
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:13436
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8500
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:14316
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:19876
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:13668
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:20488
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:20800
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:21368
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:21712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:21964
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:21988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:23116
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11352
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:11584
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10940
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:1828
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:4724
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:8704
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:8876
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:9056
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8244
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:8500
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:19608
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9592
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9636
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        7⤵
        
        PID:13336
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:12000
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:7544
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8048
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:8240
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        Clears Windows event logs
        
        PID:8796
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:10368
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:10852
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:10864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:14688
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:14780
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:14904
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:15128
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:11036
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:18528
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        Clears Windows event logs
        
        PID:17212
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:11128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20188
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:488
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "488" "2164" "1936" "2160" "0" "0" "2176" "0" "0" "0" "0" "0"
        5⤵
        
        PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:1140
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7264
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:16716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10388
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9092
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:8212
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:7636
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12696
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:14496
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:8504
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:14584
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:20148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:12864
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:13276
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:14292
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:15288
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:17320
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:13708
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:22300
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:13380
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:18368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:12820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:12564
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17780
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:4400
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7604
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8712
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10076
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:8592
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:8560
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:14932
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:14284
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:12160
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:18304
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:19964
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:22740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:19624
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:20300
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:20308
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:19156
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20644
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:20792
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:21780
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:21980
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:21972
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:22172
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:22328
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:21868
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:11532
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17744
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:5332
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:3548
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:5724
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6332
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:6764
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:7160
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:7392
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:8812
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:8700
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:9512
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7008
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:5640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:13920
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:18584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12116
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:9696
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10184
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:8012
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:7852
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:12140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:12164
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:10944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:11840
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:19764
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:21260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:22024
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7588
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:15492
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:15588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:15580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:15760
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15836
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:13044
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:16888
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:19348
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:13680
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8876
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:11116
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:13880
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:17616
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:2724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11020
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:18108
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:9248
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        Discovers running processes
        
        PID:15652
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:10508
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:10208
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "10208" "1752" "1800" "1724" "0" "0" "1788" "0" "0" "0" "0" "0"
        7⤵
        
        PID:2592
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7384
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:12320
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:12348
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:6904
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:10448
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:19756
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:16768
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:17712
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20752
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:21036
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:21120
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:21388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:11452
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6148
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6148" "2208" "2132" "2220" "0" "0" "2224" "0" "0" "0" "0" "0"
        5⤵
        
        PID:21740
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:6228
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10256
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:17492
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:11300
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10624
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:9556
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:11892
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16336
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:10952
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:11324
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:15688
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:20512
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:13404
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:6424
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:15396
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:19816
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:19648
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:15244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9668
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17552
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:6244
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10408
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        7⤵
        
        PID:12936
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:7268
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:10008
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:9588
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:10788
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:16324
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:12284
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12416
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:19436
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:9200
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl "Windows PowerShell"
        6⤵
        
        PID:13568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:8196
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:3376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:9512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
        6⤵
        
        PID:17688
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
        6⤵
        Modifies registry key
        
        PID:20848
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:21424
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:18628
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22060
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:22016
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:11140
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17600
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:6260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:6372
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7404
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:1512
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:7696
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:8300
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:8552
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:5636
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7132
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:8652
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:10272
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10708
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:19948
    - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        5⤵
        
        PID:11296
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14740
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:7280
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:11272
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:11332
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:12156
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:12280
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:10416
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7764
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:4952
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:21408
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:21572
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8096
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:10548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:11064
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
      4⤵
      Modifies registry key
      PID:15908
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15000
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guardian
      4⤵
      PID:13288
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:15548
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:21464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:17624
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:13172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:17328
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8664
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:11948
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13048
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    3⤵
    PID:14980
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:19640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --remote-debugging-port=9222 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6 --disable-gpu --no-sandbox --disable-features=IsolateOrigins,site-per-process --window-size=1920,1080
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffdb2eac728,0x7ffdb2eac734,0x7ffdb2eac740
    3⤵
    PID:4144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
    3⤵
    PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
    3⤵
    PID:2816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
    3⤵
    PID:5076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:15248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:15476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:4664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:17988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:12156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:16956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\chrome_debug_9b75c6" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,15648570796077952907,16958211877056025105,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:16896
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn OneDriveSetupUpdate /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:5832
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsSecurityUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
  2⤵
  - Adds Run key to start application
  PID:4692
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsSecurityUpdate /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v UserProfileUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
  2⤵
  - Modifies registry key
  PID:4792
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn UserProfileUpdate /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  PID:1512
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2404
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:6888
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:7048
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /f
  2⤵
  - Modifies registry key
  PID:7096
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:8252
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:8332
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\2026-09-04_29dbc1c98d69e57bde4d52c08b0264ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:8684
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:7084
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:3252
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:9700
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:684

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:480
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:2476
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:2360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:7348
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "7348" "2180" "1940" "2136" "0" "0" "2192" "0" "0" "0" "0" "0"
        5⤵
        
        PID:17996
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7412
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:804
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:14252
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:10680
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "10680" "1800" "1108" "1864" "0" "0" "1852" "0" "0" "0" "0" "0"
        7⤵
        
        PID:17048
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:11728
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:7904
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:16432
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12540
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:20884
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22068
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:19716
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:19680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:14560
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:19664
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7456
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:15192
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:15284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:15276
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:14592
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:14068
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:19412
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:13488
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:17328
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:9864
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:19696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:8196
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:13492
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20608
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:20724
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:20868
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:20908
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:22212
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:22288
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:17164
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:16992
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:13624
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9504
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:13524
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13280
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7472
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:15412
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15536
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "15536" "1828" "1660" "1816" "0" "0" "1812" "0" "0" "0" "0" "0"
        7⤵
        
        PID:15756
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:15544
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:15728
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:15844
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:4740
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:10448
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:12900
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:19832
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:984
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:16332
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14332
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      PID:7488
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:7500
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      Clears Windows event logs
      PID:2120
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:8580
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8588
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:6308
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      PID:8492
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      Clears Windows event logs
      PID:9996
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:2328
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7216
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:9156
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:8780
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:23136
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:17864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:11852
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      PID:11972
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:11980
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:12128
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:12176
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:12272
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:15672
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:16328
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:12544
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:19428
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:9824
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:8808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:13984
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:17960
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:17932
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:16876
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:18680
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:20032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:20072
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:11324
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:22188
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10984
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:12512
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:16552
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3104
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:4800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:6512
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:14056
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        Clears Windows event logs
        
        PID:13996
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:11128
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:12404
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "12404" "1868" "1676" "1860" "0" "0" "1876" "0" "0" "0" "0" "0"
        7⤵
        
        PID:22272
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        
        PID:13868
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:14376
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:15660
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:21360
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:21480
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Microsoft-Windows-PowerShell/Operational
        6⤵
        
        PID:21912
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11632
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:12632
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:14792
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:19656
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:6772
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:13428
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:13588
        
        C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "13588" "1812" "1732" "1800" "0" "0" "1816" "0" "0" "0" "0" "0"
        7⤵
        
        PID:21100
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:13568
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:14624
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:12452
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5328
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:18152
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:22044
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:22292
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:9104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:20344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20912
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:17204
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:12992
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:14184
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:13576
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15312
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:6816
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:13716
      - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn StubWatcher /f
        6⤵
        
        PID:10668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:11560
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:13532
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:9464
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6084
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:19852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:16492
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15740
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:6876
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      PID:7028
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:7076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:7604
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:8284
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:8596
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:7360
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:6852
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      Clears Windows event logs
      PID:9352
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:8972
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7228
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:7160
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:9164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:16420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:12204
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7808
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:7648
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:10720
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:1512
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:10804
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:8796
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:15900
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:11320
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      PID:19420
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:10956
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:11112
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9884
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:8956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:17476
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:17336
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:19860
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      PID:20464
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:20472
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:8444
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:19540
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:21516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:21756
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:22776
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11124
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:11424
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:16180
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:17264
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:22784
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:6324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:9140
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:17340
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:20764
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:20928
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
        6⤵
        Modifies registry key
        
        PID:21136
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:21644
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
        6⤵
        
        PID:20868
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Security
        6⤵
        
        PID:20820
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
        6⤵
        
        PID:21828
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:23496
      - C:\Windows\system32\schtasks.exe
        
        schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
        6⤵
        
        PID:1960
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl Application
        6⤵
        
        PID:16748
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:12656
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:15516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:18796
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:8988
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11860
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:12736
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:19616
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:11728
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:20352
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
        6⤵
        
        PID:17916
      - C:\Windows\system32\wevtutil.exe
        
        wevtutil cl System
        6⤵
        
        PID:14752
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:9896
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:13264
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:7096
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:8908
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:7280
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:9892
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7860
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:8120
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:9084
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:7392
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      Clears Windows event logs
      PID:10104
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:3252
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:7368
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:6236
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:9508
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:12112
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:11496
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:9700
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:7388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:14696
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
        5⤵
        
        PID:19168
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        Discovers running processes
        
        PID:16652
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      PID:10208
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:11528
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:11780
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:12036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:12088
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:12120
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:14176
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:12716
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:15144
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:19524
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      Clears Windows event logs
      PID:18612
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:7140
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:6888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:14652
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:14836
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:14828
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:14976
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      Modifies registry key
      PID:15028
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15036
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:14960
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:19452
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:10560
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:15836
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:21472
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:15184
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8604
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:11156
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:14088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:20820
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
      4⤵
      PID:20956
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe --guardian
      4⤵
      PID:20972
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:22008
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:18076
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:15040
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:21892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:22216
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:17652
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:16624
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10652
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:11192
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:19372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe
    3⤵
    PID:6900
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:16848
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemConfigUpdate /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5928
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn SystemConfigUpdate /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:940
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /f
  2⤵
  - Modifies registry key
  PID:4848
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:1460
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:3420
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDriveSetup.exe /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6808
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:6556
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:4336
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:7632
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:8616
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:9824
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:7764

C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
1⤵
- Executes dropped EXE
PID:2344
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:860
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8548
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:9536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        
        C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
        5⤵
        
        PID:11952
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:12664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:12228
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      Modifies registry key
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:10844
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:7540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:9680
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:15256
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:15216
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:15816
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:15912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:17528
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:18112
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9876
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:10224
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:13648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:17836
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:16232
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:13860
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:10316
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      Modifies registry key
      PID:16304
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:21240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:9104
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:19396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:9200
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:13204
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11036
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:11228
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:16944
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:12396
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:19264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:6572
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:6636
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9124
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:11044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq stub.exe" /nh
        5⤵
        
        PID:20256
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:8240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:12992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:13180
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:13212
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      Modifies registry key
      PID:13288
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:13304
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:15352
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:16292
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      Clears Windows event logs
      PID:9828
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Windows PowerShell"
      4⤵
      PID:19444
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:4616
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Microsoft-Windows-PowerShell/Operational
      4⤵
      PID:17316
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9544
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:9016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:17644
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:17660
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:17792
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:18044
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      Clears Windows event logs
      PID:18348
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      PID:7488
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:19980
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:22144
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:22092
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:844
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application
      4⤵
      PID:22396
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:20960
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:8500
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:11376
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13088
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:23144
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:12140
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
  2⤵
  PID:6660
- C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
  2⤵
  PID:6736
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:15024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:14664
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:15448
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      Modifies registry key
      PID:15404
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:15460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:15628
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:16660
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
      4⤵
      PID:18764
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:16348
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
      4⤵
      PID:17296
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:8212
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:11468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:21964
  - - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
      C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe --guardian
      4⤵
      PID:12532
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:22052
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /f
      4⤵
      PID:15440
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:21836
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:12524
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe
    3⤵
    PID:11784
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:17728
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:6840
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:6856
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  - Clears Windows event logs
  PID:8232
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:8296
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:8612
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:7860
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:8136
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:9672
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:7824

C:\ProgramData\Microsoft\Windows\SystemConfig.exe
C:\ProgramData\Microsoft\Windows\SystemConfig.exe
1⤵
PID:6540
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:6412
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:1512
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:8416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      PID:8420
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:10668
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
      4⤵
      PID:15568
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:18740
  - - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
      C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
      4⤵
      PID:20572
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn StubWatcher /f
      4⤵
      PID:21760
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System
      4⤵
      PID:21772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security
      4⤵
      PID:15548
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
      4⤵
      PID:22916
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9984
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:14852
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:17380
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:13480
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:18756
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:7768
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:11108
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:11180
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:14540
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:14508
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:17432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:7092
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d C:\ProgramData\Microsoft\Windows\SystemConfig.exe /f
  2⤵
  - Modifies registry key
  PID:8664
- C:\ProgramData\Microsoft\Windows\SystemConfig.exe
  C:\ProgramData\Microsoft\Windows\SystemConfig.exe --guardian
  2⤵
  PID:7700
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:10280
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:6800
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:17632
- - C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    C:\ProgramData\Microsoft\Windows\SystemConfig.exe
    3⤵
    PID:16856
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13048
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:8500
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:6900
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr C:\ProgramData\Microsoft\Windows\SystemConfig.exe /sc onlogon /ru SYSTEM /f
  2⤵
  PID:6796
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:3408
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:7268
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:8860
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:9640
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:10680

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
1⤵
PID:7680
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:5140
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:9076
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:11640
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:12692
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:15296
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:14768
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:8436
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:6504
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:10892
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:11528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:20780
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
      4⤵
      PID:20948
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    - Discovers running processes
    PID:10024
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:14736
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:13940
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /f
  2⤵
  PID:6344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Public\self_monitor.ps1
  2⤵
  PID:8588
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn StubWatcher /f
  2⤵
  PID:7820
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" --guardian
  2⤵
  PID:9584
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:12608
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe"
    3⤵
    PID:7312
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq stub.exe" /nh
    3⤵
    PID:20204
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  PID:7636
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn StubWatcher /xml C:\Users\Admin\AppData\Local\Temp\watchdog_task.xml /f
  2⤵
  PID:7904
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdateService /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UserProfile.exe" /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6956
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  PID:7364
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn StubWatcher /ru SYSTEM /rl HIGHEST
  2⤵
  PID:8552
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  PID:7816
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  PID:8532
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:10836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
PID:6188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
1⤵
PID:22080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Authentication Process

Modify Registry

T1112

Credential Access

Modify Authentication Process