cerber | 02d3b89a95b85e771778e723adf7d9bba0509047d00f43fc2e9f26188c88a16a

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe
File opened (read-only)	\??\F:	DevManView.exe
File opened (read-only)	\??\D:	DevManView.exe

Maps connected drives based on registry 3 TTPs 64 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DevManView.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	DevManView.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2560	sc.exe
2612	sc.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DevManView.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DevManView.exe

Kills process with taskkill 19 IoCs

evasion

pid	Process
2820	taskkill.exe
2920	taskkill.exe
536	taskkill.exe
1872	taskkill.exe
2296	taskkill.exe
2776	taskkill.exe
3024	taskkill.exe
1264	taskkill.exe
2968	taskkill.exe
2528	taskkill.exe
988	taskkill.exe
1444	taskkill.exe
2536	taskkill.exe
1308	taskkill.exe
2704	taskkill.exe
2768	taskkill.exe
1576	taskkill.exe
2700	taskkill.exe
2808	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
308	PING.EXE
2392	PING.EXE
2164	PING.EXE
3032	PING.EXE
2648	PING.EXE
2700	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2708	DevManView.exe
3036	DriveCleanup.exe
3036	DriveCleanup.exe
2860	DevManView.exe
2932	DevManView.exe
3012	DevManView.exe
2568	DevManView.exe
2432	DevManView.exe
2452	DevManView.exe
1976	DevManView.exe
2636	DevManView.exe
1580	DevManView.exe
1660	DevManView.exe
2036	DevManView.exe
2724	DevManView.exe
1620	DevManView.exe
1684	DevManView.exe
1268	DevManView.exe
2896	DevManView.exe
1844	DevManView.exe
1532	DevManView.exe
868	DevManView.exe
1036	DevManView.exe
2976	DevManView.exe
900	DevManView.exe
1148	DevManView.exe
1712	DevManView.exe
2988	DevManView.exe
840	DevManView.exe
2024	DevManView.exe
2620	DevManView.exe
892	DevManView.exe
1752	DevManView.exe
2624	DevManView.exe
1812	DevManView.exe
2944	DevManView.exe
2688	DevManView.exe
2832	DevManView.exe
1304	DevManView.exe
2440	DevManView.exe
1816	DevManView.exe
1820	DevManView.exe
1876	DevManView.exe
1868	DevManView.exe
112	DevManView.exe
1672	DevManView.exe
2172	DevManView.exe
1152	DevManView.exe
1684	DevManView.exe
2896	DevManView.exe
1844	DevManView.exe
1292	DevManView.exe
2276	DevManView.exe
2104	DevManView.exe
2092	DevManView.exe
2500	DevManView.exe
2264	DevManView.exe
1496	DevManView.exe
2408	DevManView.exe
2328	DevManView.exe
444	DevManView.exe
1852	DevManView.exe
1564	DevManView.exe
1992	DevManView.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeBackupPrivilege	2708	DevManView.exe
Token: SeRestorePrivilege	2708	DevManView.exe
Token: SeTakeOwnershipPrivilege	2708	DevManView.exe
Token: SeImpersonatePrivilege	2708	DevManView.exe
Token: SeLoadDriverPrivilege	3040	DeviceCleanupCmd.exe
Token: SeSecurityPrivilege	3040	DeviceCleanupCmd.exe
Token: SeDebugPrivilege	3040	DeviceCleanupCmd.exe
Token: SeLoadDriverPrivilege	3036	DriveCleanup.exe
Token: SeSecurityPrivilege	3036	DriveCleanup.exe
Token: SeDebugPrivilege	3036	DriveCleanup.exe
Token: SeIncreaseQuotaPrivilege	3036	DriveCleanup.exe
Token: SeDebugPrivilege	3036	DriveCleanup.exe
Token: SeBackupPrivilege	2860	DevManView.exe
Token: SeRestorePrivilege	2860	DevManView.exe
Token: SeTakeOwnershipPrivilege	2860	DevManView.exe
Token: SeImpersonatePrivilege	2860	DevManView.exe
Token: SeBackupPrivilege	2932	DevManView.exe
Token: SeRestorePrivilege	2932	DevManView.exe
Token: SeTakeOwnershipPrivilege	2932	DevManView.exe
Token: SeImpersonatePrivilege	2932	DevManView.exe
Token: SeBackupPrivilege	3012	DevManView.exe
Token: SeRestorePrivilege	3012	DevManView.exe
Token: SeTakeOwnershipPrivilege	3012	DevManView.exe
Token: SeImpersonatePrivilege	3012	DevManView.exe
Token: SeBackupPrivilege	2568	DevManView.exe
Token: SeRestorePrivilege	2568	DevManView.exe
Token: SeTakeOwnershipPrivilege	2568	DevManView.exe
Token: SeImpersonatePrivilege	2568	DevManView.exe
Token: SeBackupPrivilege	2432	DevManView.exe
Token: SeRestorePrivilege	2432	DevManView.exe
Token: SeTakeOwnershipPrivilege	2432	DevManView.exe
Token: SeImpersonatePrivilege	2432	DevManView.exe
Token: SeBackupPrivilege	2452	DevManView.exe
Token: SeRestorePrivilege	2452	DevManView.exe
Token: SeTakeOwnershipPrivilege	2452	DevManView.exe
Token: SeImpersonatePrivilege	2452	DevManView.exe
Token: SeBackupPrivilege	1976	DevManView.exe
Token: SeRestorePrivilege	1976	DevManView.exe
Token: SeTakeOwnershipPrivilege	1976	DevManView.exe
Token: SeImpersonatePrivilege	1976	DevManView.exe
Token: SeBackupPrivilege	2636	DevManView.exe
Token: SeRestorePrivilege	2636	DevManView.exe
Token: SeTakeOwnershipPrivilege	2636	DevManView.exe
Token: SeImpersonatePrivilege	2636	DevManView.exe
Token: SeBackupPrivilege	1580	DevManView.exe
Token: SeRestorePrivilege	1580	DevManView.exe
Token: SeTakeOwnershipPrivilege	1580	DevManView.exe
Token: SeImpersonatePrivilege	1580	DevManView.exe
Token: SeBackupPrivilege	1660	DevManView.exe
Token: SeRestorePrivilege	1660	DevManView.exe
Token: SeTakeOwnershipPrivilege	1660	DevManView.exe
Token: SeImpersonatePrivilege	1660	DevManView.exe
Token: SeBackupPrivilege	2036	DevManView.exe
Token: SeRestorePrivilege	2036	DevManView.exe
Token: SeTakeOwnershipPrivilege	2036	DevManView.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2392	2220	cmd.exe	29
PID 2220 wrote to memory of 2392	2220	cmd.exe	29
PID 2220 wrote to memory of 2392	2220	cmd.exe	29
PID 2220 wrote to memory of 1736	2220	cmd.exe	30
PID 2220 wrote to memory of 1736	2220	cmd.exe	30
PID 2220 wrote to memory of 1736	2220	cmd.exe	30
PID 2220 wrote to memory of 2296	2220	cmd.exe	31
PID 2220 wrote to memory of 2296	2220	cmd.exe	31
PID 2220 wrote to memory of 2296	2220	cmd.exe	31
PID 2220 wrote to memory of 2776	2220	cmd.exe	33
PID 2220 wrote to memory of 2776	2220	cmd.exe	33
PID 2220 wrote to memory of 2776	2220	cmd.exe	33
PID 2220 wrote to memory of 2820	2220	cmd.exe	34
PID 2220 wrote to memory of 2820	2220	cmd.exe	34
PID 2220 wrote to memory of 2820	2220	cmd.exe	34
PID 2220 wrote to memory of 2536	2220	cmd.exe	35
PID 2220 wrote to memory of 2536	2220	cmd.exe	35
PID 2220 wrote to memory of 2536	2220	cmd.exe	35
PID 2220 wrote to memory of 2700	2220	cmd.exe	36
PID 2220 wrote to memory of 2700	2220	cmd.exe	36
PID 2220 wrote to memory of 2700	2220	cmd.exe	36
PID 2220 wrote to memory of 2808	2220	cmd.exe	37
PID 2220 wrote to memory of 2808	2220	cmd.exe	37
PID 2220 wrote to memory of 2808	2220	cmd.exe	37
PID 2220 wrote to memory of 2920	2220	cmd.exe	38
PID 2220 wrote to memory of 2920	2220	cmd.exe	38
PID 2220 wrote to memory of 2920	2220	cmd.exe	38
PID 2220 wrote to memory of 2704	2220	cmd.exe	39
PID 2220 wrote to memory of 2704	2220	cmd.exe	39
PID 2220 wrote to memory of 2704	2220	cmd.exe	39
PID 2220 wrote to memory of 2528	2220	cmd.exe	40
PID 2220 wrote to memory of 2528	2220	cmd.exe	40
PID 2220 wrote to memory of 2528	2220	cmd.exe	40
PID 2220 wrote to memory of 2560	2220	cmd.exe	41
PID 2220 wrote to memory of 2560	2220	cmd.exe	41
PID 2220 wrote to memory of 2560	2220	cmd.exe	41
PID 2220 wrote to memory of 2612	2220	cmd.exe	42
PID 2220 wrote to memory of 2612	2220	cmd.exe	42
PID 2220 wrote to memory of 2612	2220	cmd.exe	42
PID 2220 wrote to memory of 2708	2220	cmd.exe	43
PID 2220 wrote to memory of 2708	2220	cmd.exe	43
PID 2220 wrote to memory of 2708	2220	cmd.exe	43
PID 2220 wrote to memory of 3040	2220	cmd.exe	44
PID 2220 wrote to memory of 3040	2220	cmd.exe	44
PID 2220 wrote to memory of 3040	2220	cmd.exe	44
PID 2220 wrote to memory of 3036	2220	cmd.exe	45
PID 2220 wrote to memory of 3036	2220	cmd.exe	45
PID 2220 wrote to memory of 3036	2220	cmd.exe	45
PID 2220 wrote to memory of 2860	2220	cmd.exe	46
PID 2220 wrote to memory of 2860	2220	cmd.exe	46
PID 2220 wrote to memory of 2860	2220	cmd.exe	46
PID 2220 wrote to memory of 2932	2220	cmd.exe	47
PID 2220 wrote to memory of 2932	2220	cmd.exe	47
PID 2220 wrote to memory of 2932	2220	cmd.exe	47
PID 2220 wrote to memory of 3012	2220	cmd.exe	48
PID 2220 wrote to memory of 3012	2220	cmd.exe	48
PID 2220 wrote to memory of 3012	2220	cmd.exe	48
PID 2220 wrote to memory of 2568	2220	cmd.exe	49
PID 2220 wrote to memory of 2568	2220	cmd.exe	49
PID 2220 wrote to memory of 2568	2220	cmd.exe	49
PID 2220 wrote to memory of 2432	2220	cmd.exe	50
PID 2220 wrote to memory of 2432	2220	cmd.exe	50
PID 2220 wrote to memory of 2432	2220	cmd.exe	50
PID 2220 wrote to memory of 2452	2220	cmd.exe	51

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\1. Spoofer (RUN ME).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\PING.EXE
  ping www.google.com -n 1
  2⤵
  - Runs ping.exe
  PID:2392
- C:\Windows\system32\find.exe
  find "="
  2⤵
  PID:1736
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat_Setup.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService_x64.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\system32\sc.exe
  sc stop BEService
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Windows\system32\sc.exe
  sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SWD\MS*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DeviceCleanupCmd.exe
  DeviceCleanupCmd.exe * -s
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DriveCleanup.exe
  DriveCleanup.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "F:\"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk drive*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk"
  2⤵
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "disk"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk&*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "USBSTOR*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "STORAGE*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Motherboard*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Volume*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Microsoft*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "System*" /use_wildcard
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "ACPI\*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Remote*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Standard*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SU AUTO
  2⤵
  - Cerber
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS 28156256003123214025
  2⤵
  - Cerber
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CS 3908306601974312906
  2⤵
  - Cerber
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS 23714289572200428044
  2⤵
  - Cerber
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PSN 348633992901921480
  2⤵
  - Cerber
  PID:696
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IVN 616732629186626860
  2⤵
  - Cerber
  PID:476
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IV 32727210143047121272
  2⤵
  - Cerber
  PID:2136
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  PID:988
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Cerber
  - Kills process with taskkill
  PID:536
- C:\Windows\system32\PING.EXE
  PING localhost -n 15
  2⤵
  - Runs ping.exe
  PID:2164
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "F:\"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk drive*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "disk"
  2⤵
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk&*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:840
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "USBSTOR*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "STORAGE*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Motherboard*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Volume*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Microsoft*" /use_wildcard
  2⤵
  PID:2248
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "System*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "ACPI\*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Remote*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Standard*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SU AUTO
  2⤵
  - Cerber
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS 1751427991501613992
  2⤵
  - Cerber
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CS 2487926345175329075
  2⤵
  - Cerber
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS 50393251678326675
  2⤵
  - Cerber
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PSN 2359828332242027718
  2⤵
  - Cerber
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IVN 27776274431757531892
  2⤵
  - Cerber
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IV 31006767249768498
  2⤵
  - Cerber
  PID:1984
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:2768
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:3024
- C:\Windows\system32\PING.EXE
  PING localhost -n 15
  2⤵
  - Runs ping.exe
  PID:3032
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1304
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "F:\"
  2⤵
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk drive*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk"
  2⤵
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "disk"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk&*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "USBSTOR*" /use_wildcard
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "STORAGE*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Motherboard*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Volume*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Microsoft*" /use_wildcard
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "System*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "ACPI\*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Remote*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Standard*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SU AUTO
  2⤵
  - Cerber
  PID:620
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS 831314221135111815
  2⤵
  - Cerber
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CS 2369430902174727309
  2⤵
  - Cerber
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS 12987259051577430170
  2⤵
  - Cerber
  PID:1592
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PSN 558529786515824191
  2⤵
  - Cerber
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IVN 11882279531304429265
  2⤵
  - Cerber
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IV 3212520134224822118
  2⤵
  - Cerber
  PID:2456
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:1264
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:1308
- C:\Windows\system32\PING.EXE
  PING localhost -n 15
  2⤵
  - Runs ping.exe
  PID:2648
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:2340
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "F:\"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk drive*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:444
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "disk"
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk&*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "USBSTOR*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  PID:868
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard
  2⤵
  - Enumerates connected drives
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "STORAGE*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Motherboard*" /use_wildcard
  2⤵
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  PID:2356
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Volume*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Microsoft*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "System*" /use_wildcard
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "ACPI\*" /use_wildcard
  2⤵
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Remote*" /use_wildcard
  2⤵
  PID:760
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Standard*" /use_wildcard
  2⤵
  PID:1752
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SU AUTO
  2⤵
  PID:2352
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS 337533481157719010
  2⤵
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CS 9196186991383316883
  2⤵
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS 1170325426857211513
  2⤵
  PID:108
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PSN 204144652700523627
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IVN 2309023515277658918
  2⤵
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IV 31576755325835991
  2⤵
  PID:2120
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:1576
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:2968
- C:\Windows\system32\PING.EXE
  PING localhost -n 15
  2⤵
  - Runs ping.exe
  PID:2700
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:2756
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "F:\"
  2⤵
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk drive*" /use_wildcard
  2⤵
  PID:2308
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk"
  2⤵
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "disk"
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk&*" /use_wildcard
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard
  2⤵
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "USBSTOR*" /use_wildcard
  2⤵
  PID:944
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard
  2⤵
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "STORAGE*" /use_wildcard
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Motherboard*" /use_wildcard
  2⤵
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Volume*" /use_wildcard
  2⤵
  PID:1044
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Microsoft*" /use_wildcard
  2⤵
  PID:792
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "System*" /use_wildcard
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "ACPI\*" /use_wildcard
  2⤵
  PID:304
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Remote*" /use_wildcard
  2⤵
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Standard*" /use_wildcard
  2⤵
  PID:1908
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SU AUTO
  2⤵
  PID:2344
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /BS 2427727792742111722
  2⤵
  PID:2592
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /CS 18520143943036927444
  2⤵
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /SS 1237686482011214814
  2⤵
  PID:1156
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /PSN 10737411220608179
  2⤵
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IVN 882431437507423980
  2⤵
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\AMIDEWINx64.EXE
  AMIDEWINx64.EXE /IV 423964012586814009
  2⤵
  PID:1584
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:1872
- C:\Windows\system32\taskkill.exe
  TASKKILL /F /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:1444
- C:\Windows\system32\PING.EXE
  PING localhost -n 15
  2⤵
  - Runs ping.exe
  PID:308
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  PID:1580
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "F:\"
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "C:\"
  2⤵
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk drive*" /use_wildcard
  2⤵
  PID:2492
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk"
  2⤵
  PID:1264
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "disk"
  2⤵
  PID:844
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "Disk&*" /use_wildcard
  2⤵
  PID:1296
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard
  2⤵
  PID:476
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "USBSTOR*" /use_wildcard
  2⤵
  PID:768
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard
  2⤵
  PID:332
- C:\Users\Admin\AppData\Local\Temp\UnBan Guide\step 6\DevManView.exe
  DevManView.exe /uninstall "STORAGE*" /use_wildcard
  2⤵
  PID:2608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:1432

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "ACPI\PNP0C01\2&daba3ff&2" "" "" "639932b5f" "0000000000000000" "00000000000005D0" "00000000000005A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2876

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "ACPI\PNP0103\0" "" "" "6b512ed67" "0000000000000000" "00000000000005F8" "0000000000000618"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery