Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/07/2024, 23:12
240707-26tgkstaqe 10Analysis
-
max time kernel
125s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
Oneclick-V6.7.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Oneclick-V6.7.bat
Resource
win10v2004-20240704-en
General
-
Target
Oneclick-V6.7.bat
-
Size
202KB
-
MD5
4acd7d1e7294d4ab4e9db8977d5135e4
-
SHA1
07c5474fcd09ff5843df3f776d665dcf0eef4284
-
SHA256
b66cd5d6a39c016d0c39e270bed5cc8dbeb1920b3f827d78bc9d36a4a1e3f84f
-
SHA512
d45a1a26440116df843fbef3bc86a727267cc687f59f9062ef9a66c08a3581c9903d568303d5700dacaad7f5e398601211841328e1784989822d644a426b2d36
-
SSDEEP
1536:97SPKdigMQgPTjIV4wJzSwTgfGH/ngfHH4pX/paZSiDk2IWOmXmomk:9nnHgvOh4KmXmomk
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
pid Process 3028 bcdedit.exe -
pid Process 920 powershell.exe 2404 powershell.exe 2636 powershell.exe 2828 powershell.exe 2788 powershell.exe 1036 powershell.exe 684 powershell.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2328 powercfg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe -
Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 1304 powershell.exe -
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1520 sc.exe 904 sc.exe 1260 sc.exe 668 sc.exe 3044 sc.exe 2904 sc.exe 2740 sc.exe 2604 sc.exe 1824 sc.exe 2848 sc.exe 2372 sc.exe 600 sc.exe 1556 sc.exe 2128 sc.exe 2984 sc.exe 2388 sc.exe 1056 sc.exe 912 sc.exe 2716 sc.exe 1400 sc.exe 2116 sc.exe 2996 sc.exe 1804 sc.exe 2852 sc.exe 892 sc.exe 1332 sc.exe 2188 sc.exe 568 sc.exe 2488 sc.exe 1384 sc.exe 556 sc.exe 2872 sc.exe 2672 sc.exe 1652 sc.exe 1308 sc.exe 908 sc.exe 2496 sc.exe 2364 sc.exe 1496 sc.exe 1936 sc.exe 1156 sc.exe 1040 sc.exe 1560 sc.exe 2244 sc.exe 1036 sc.exe 2476 sc.exe 1388 sc.exe 1544 sc.exe 856 sc.exe 2680 sc.exe 1700 sc.exe 2292 sc.exe 2820 sc.exe 2236 sc.exe 2192 sc.exe 1484 sc.exe 564 sc.exe 2536 sc.exe 1640 sc.exe 2660 sc.exe 2072 sc.exe 2956 sc.exe 2352 sc.exe 2932 sc.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 876 timeout.exe 1484 timeout.exe 1764 timeout.exe 1760 timeout.exe 2408 timeout.exe 2940 timeout.exe 860 timeout.exe 3008 timeout.exe 688 timeout.exe 1136 timeout.exe 2684 timeout.exe 908 timeout.exe 2516 timeout.exe 2916 timeout.exe 904 timeout.exe 1844 timeout.exe 1592 timeout.exe 2504 timeout.exe 2056 timeout.exe 856 timeout.exe 1936 timeout.exe 2372 timeout.exe 448 timeout.exe 1836 timeout.exe 2792 timeout.exe 1040 timeout.exe 1152 timeout.exe 880 timeout.exe 2160 timeout.exe 1056 timeout.exe 1552 timeout.exe 1784 timeout.exe 2408 timeout.exe 2780 timeout.exe 2932 timeout.exe 2748 timeout.exe 792 timeout.exe 1520 timeout.exe 600 timeout.exe 2332 timeout.exe 1700 timeout.exe 2360 timeout.exe 1928 timeout.exe 2804 timeout.exe 2964 timeout.exe 2844 timeout.exe 2608 timeout.exe 2760 timeout.exe 2488 timeout.exe 1316 timeout.exe 1920 timeout.exe 2028 timeout.exe 1304 timeout.exe 1188 timeout.exe 2772 timeout.exe 2560 timeout.exe 1672 timeout.exe 844 timeout.exe 1352 timeout.exe 544 timeout.exe 2812 timeout.exe 1496 timeout.exe 1992 timeout.exe 2128 timeout.exe -
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
-
Modifies data under HKEY_USERS 45 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard reg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "80000002" reg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2} powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32\ powershell.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 powershell.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\CLSID powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2332 reg.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2828 powershell.exe 2788 powershell.exe 1036 powershell.exe 1304 powershell.exe 920 powershell.exe 2404 powershell.exe 2636 powershell.exe 684 powershell.exe 684 powershell.exe 684 powershell.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2828 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 1036 powershell.exe Token: SeBackupPrivilege 2020 vssvc.exe Token: SeRestorePrivilege 2020 vssvc.exe Token: SeAuditPrivilege 2020 vssvc.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeRestorePrivilege 2800 DrvInst.exe Token: SeLoadDriverPrivilege 2800 DrvInst.exe Token: SeLoadDriverPrivilege 2800 DrvInst.exe Token: SeLoadDriverPrivilege 2800 DrvInst.exe Token: SeDebugPrivilege 1304 powershell.exe Token: SeDebugPrivilege 920 powershell.exe Token: SeDebugPrivilege 2404 powershell.exe Token: SeShutdownPrivilege 2328 powercfg.exe Token: SeShutdownPrivilege 2328 powercfg.exe Token: SeShutdownPrivilege 2328 powercfg.exe Token: SeShutdownPrivilege 2328 powercfg.exe Token: SeShutdownPrivilege 2328 powercfg.exe Token: SeCreatePagefilePrivilege 2328 powercfg.exe Token: SeDebugPrivilege 2636 powershell.exe Token: SeDebugPrivilege 684 powershell.exe Token: SeDebugPrivilege 1960 taskmgr.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe -
Suspicious use of SendNotifyMessage 52 IoCs
pid Process 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe 1960 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2600 2064 cmd.exe 31 PID 2064 wrote to memory of 2600 2064 cmd.exe 31 PID 2064 wrote to memory of 2600 2064 cmd.exe 31 PID 2064 wrote to memory of 2180 2064 cmd.exe 32 PID 2064 wrote to memory of 2180 2064 cmd.exe 32 PID 2064 wrote to memory of 2180 2064 cmd.exe 32 PID 2064 wrote to memory of 1792 2064 cmd.exe 33 PID 2064 wrote to memory of 1792 2064 cmd.exe 33 PID 2064 wrote to memory of 1792 2064 cmd.exe 33 PID 2064 wrote to memory of 2068 2064 cmd.exe 34 PID 2064 wrote to memory of 2068 2064 cmd.exe 34 PID 2064 wrote to memory of 2068 2064 cmd.exe 34 PID 2064 wrote to memory of 1744 2064 cmd.exe 35 PID 2064 wrote to memory of 1744 2064 cmd.exe 35 PID 2064 wrote to memory of 1744 2064 cmd.exe 35 PID 2064 wrote to memory of 1760 2064 cmd.exe 36 PID 2064 wrote to memory of 1760 2064 cmd.exe 36 PID 2064 wrote to memory of 1760 2064 cmd.exe 36 PID 2064 wrote to memory of 1712 2064 cmd.exe 37 PID 2064 wrote to memory of 1712 2064 cmd.exe 37 PID 2064 wrote to memory of 1712 2064 cmd.exe 37 PID 2064 wrote to memory of 2172 2064 cmd.exe 38 PID 2064 wrote to memory of 2172 2064 cmd.exe 38 PID 2064 wrote to memory of 2172 2064 cmd.exe 38 PID 2064 wrote to memory of 2432 2064 cmd.exe 39 PID 2064 wrote to memory of 2432 2064 cmd.exe 39 PID 2064 wrote to memory of 2432 2064 cmd.exe 39 PID 2432 wrote to memory of 2972 2432 net.exe 40 PID 2432 wrote to memory of 2972 2432 net.exe 40 PID 2432 wrote to memory of 2972 2432 net.exe 40 PID 2064 wrote to memory of 2332 2064 cmd.exe 41 PID 2064 wrote to memory of 2332 2064 cmd.exe 41 PID 2064 wrote to memory of 2332 2064 cmd.exe 41 PID 2064 wrote to memory of 2516 2064 cmd.exe 42 PID 2064 wrote to memory of 2516 2064 cmd.exe 42 PID 2064 wrote to memory of 2516 2064 cmd.exe 42 PID 2064 wrote to memory of 2844 2064 cmd.exe 43 PID 2064 wrote to memory of 2844 2064 cmd.exe 43 PID 2064 wrote to memory of 2844 2064 cmd.exe 43 PID 2064 wrote to memory of 2864 2064 cmd.exe 44 PID 2064 wrote to memory of 2864 2064 cmd.exe 44 PID 2064 wrote to memory of 2864 2064 cmd.exe 44 PID 2064 wrote to memory of 2860 2064 cmd.exe 45 PID 2064 wrote to memory of 2860 2064 cmd.exe 45 PID 2064 wrote to memory of 2860 2064 cmd.exe 45 PID 2064 wrote to memory of 2828 2064 cmd.exe 46 PID 2064 wrote to memory of 2828 2064 cmd.exe 46 PID 2064 wrote to memory of 2828 2064 cmd.exe 46 PID 2064 wrote to memory of 2788 2064 cmd.exe 48 PID 2064 wrote to memory of 2788 2064 cmd.exe 48 PID 2064 wrote to memory of 2788 2064 cmd.exe 48 PID 2064 wrote to memory of 1768 2064 cmd.exe 51 PID 2064 wrote to memory of 1768 2064 cmd.exe 51 PID 2064 wrote to memory of 1768 2064 cmd.exe 51 PID 2064 wrote to memory of 1544 2064 cmd.exe 52 PID 2064 wrote to memory of 1544 2064 cmd.exe 52 PID 2064 wrote to memory of 1544 2064 cmd.exe 52 PID 2064 wrote to memory of 576 2064 cmd.exe 53 PID 2064 wrote to memory of 576 2064 cmd.exe 53 PID 2064 wrote to memory of 576 2064 cmd.exe 53 PID 2064 wrote to memory of 2684 2064 cmd.exe 54 PID 2064 wrote to memory of 2684 2064 cmd.exe 54 PID 2064 wrote to memory of 2684 2064 cmd.exe 54 PID 2064 wrote to memory of 1036 2064 cmd.exe 55 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V6.7.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\fltMC.exefltmc2⤵PID:2600
-
-
C:\Windows\system32\sc.exesc query "WinDefend"2⤵PID:2180
-
-
C:\Windows\system32\find.exefind "STATE"2⤵PID:1792
-
-
C:\Windows\system32\find.exefind "RUNNING"2⤵PID:2068
-
-
C:\Windows\system32\sc.exesc qc "TrustedInstaller"2⤵PID:1744
-
-
C:\Windows\system32\find.exefind "START_TYPE"2⤵PID:1760
-
-
C:\Windows\system32\find.exefind "DISABLED"2⤵PID:1712
-
-
C:\Windows\system32\sc.exesc config TrustedInstaller start=auto2⤵PID:2172
-
-
C:\Windows\system32\net.exenet start TrustedInstaller2⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TrustedInstaller3⤵PID:2972
-
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2332
-
-
C:\Windows\system32\chcp.comchcp 650012⤵PID:2516
-
-
C:\Windows\system32\timeout.exetimeout 22⤵
- Delays execution with timeout.exe
PID:2844
-
-
C:\Windows\system32\chcp.comchcp 650012⤵PID:2864
-
-
C:\Windows\system32\chcp.comchcp 4372⤵PID:2860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Write-Host 'Recommended!' -ForegroundColor White -BackgroundColor Red"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f2⤵PID:1768
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f2⤵PID:1544
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f2⤵PID:576
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Checkpoint-Computer -Description 'OneClick V6.7 Restore Point'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Windows\system32\timeout.exetimeout 22⤵
- Delays execution with timeout.exe
PID:1700
-
-
C:\Windows\system32\chcp.comchcp 650012⤵PID:408
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:844
-
-
C:\Windows\system32\chcp.comchcp 4372⤵PID:1868
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d 0 /f2⤵PID:3004
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "PublishUserActivities" /t REG_DWORD /d 0 /f2⤵PID:2604
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "UploadUserActivities" /t REG_DWORD /d 0 /f2⤵PID:2292
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2608
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v "Value" /t REG_SZ /d "Deny" /f2⤵PID:904
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "SensorPermissionState" /t REG_DWORD /d 0 /f2⤵PID:616
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\lfsvc\Service\Configuration" /v "Status" /t REG_DWORD /d 0 /f2⤵PID:1812
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\Maps" /v "AutoUpdateEnabled" /t REG_DWORD /d 0 /f2⤵PID:956
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1352
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f2⤵PID:688
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f2⤵PID:1872
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Remove-Item -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy' -Recurse -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1316
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f2⤵PID:1336
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:544
-
-
C:\Windows\system32\reg.exereg.exe add "HKU\.DEFAULT\Control Panel\Keyboard" /v InitialKeyboardIndicators /t REG_DWORD /d 80000002 /f2⤵
- Modifies data under HKEY_USERS
PID:1560
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "New-Item -Path 'HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}' -Name 'InprocServer32' -Force -Value ''"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2360
-
-
C:\Windows\system32\reg.exereg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 0 /f2⤵
- Modifies visibility of file extensions in Explorer
PID:2316
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1920
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f2⤵PID:2392
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2408
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarDa /t REG_DWORD /d 0 /f2⤵PID:2000
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1928
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "0" /f2⤵PID:1640
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "200" /f2⤵PID:2264
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /d "0" /f2⤵PID:1032
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Keyboard" /v "KeyboardDelay" /t REG_DWORD /d 0 /f2⤵PID:2112
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d 0 /f2⤵PID:892
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d 0 /f2⤵PID:2552
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d 0 /f2⤵PID:1952
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d 3 /f2⤵PID:2208
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /t REG_DWORD /d 0 /f2⤵PID:2356
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f2⤵PID:884
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f2⤵PID:1508
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f2⤵PID:1048
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f2⤵PID:1028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'UserPreferencesMask' -Type Binary -Value ([byte[]](144,18,3,128,16,0,0,0))"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1152
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v GameDVR_FSEBehavior /t REG_DWORD /d 2 /f2⤵PID:1576
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v GameDVR_Enabled /t REG_DWORD /d 0 /f2⤵PID:2600
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v GameDVR_DXGIHonorFSEWindowsCompatible /t REG_DWORD /d 1 /f2⤵PID:2540
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v GameDVR_HonorUserFSEBehaviorMode /t REG_DWORD /d 1 /f2⤵PID:2180
-
-
C:\Windows\system32\reg.exereg add "HKCU\System\GameConfigStore" /v GameDVR_EFSEFeatureFlags /t REG_DWORD /d 0 /f2⤵PID:2052
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f2⤵PID:1724
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v BingSearchEnabled /t REG_DWORD /d 0 /f2⤵PID:1924
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1760
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\GameBar" /v "AllowAutoGameMode" /t REG_DWORD /d 0 /f2⤵PID:1712
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d 0 /f2⤵PID:2400
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2812
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d 2 /f2⤵PID:668
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2056
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f2⤵
- Modifies registry key
PID:2332
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2516
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f2⤵PID:2856
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f2⤵PID:2868
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f2⤵PID:3000
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:880
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Control\Session Manager\Power" /v HibernateEnabled /t REG_DWORD /d 0 /f2⤵PID:2876
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings" /v ShowHibernateOption /t REG_DWORD /d 0 /f2⤵PID:2632
-
-
C:\Windows\system32\powercfg.exepowercfg.exe /hibernate off2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2748
-
-
C:\Windows\system32\sc.exesc config HomeGroupListener start=demand2⤵PID:2988
-
-
C:\Windows\system32\sc.exesc config HomeGroupProvider start=demand2⤵
- Launches sc.exe
PID:2984
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2780
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" /v "Value" /t REG_DWORD /d 0 /f2⤵PID:2784
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" /v "Value" /t REG_DWORD /d 0 /f2⤵PID:2872
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2804
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 1 /f2⤵PID:2508
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2760
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "DisabledComponents" /t REG_DWORD /d 255 /f2⤵PID:2680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Disable-NetAdapterBinding -Name '*' -ComponentID ms_tcpip6"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1188
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v EnableLUA /t REG_DWORD /d 02⤵
- UAC bypass
PID:2672
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:856
-
-
C:\Windows\system32\chcp.comchcp 4372⤵PID:1020
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1484
-
-
C:\Windows\system32\sc.exesc config AJRouter start=disabled2⤵PID:1320
-
-
C:\Windows\system32\sc.exesc config ALG start=demand2⤵PID:2012
-
-
C:\Windows\system32\sc.exesc config AppIDSvc start=demand2⤵PID:2596
-
-
C:\Windows\system32\sc.exesc config AppMgmt start=demand2⤵PID:1788
-
-
C:\Windows\system32\sc.exesc config AppReadiness start=demand2⤵
- Launches sc.exe
PID:2388
-
-
C:\Windows\system32\sc.exesc config AppVClient start=disabled2⤵
- Launches sc.exe
PID:2932
-
-
C:\Windows\system32\sc.exesc config AppXSvc start=demand2⤵PID:2712
-
-
C:\Windows\system32\sc.exesc config Appinfo start=demand2⤵PID:2660
-
-
C:\Windows\system32\sc.exesc config AssignedAccessManagerSvc start=disabled2⤵PID:2928
-
-
C:\Windows\system32\sc.exesc config AudioEndpointBuilder start=auto2⤵PID:2080
-
-
C:\Windows\system32\sc.exesc config AudioSrv start=auto2⤵PID:2852
-
-
C:\Windows\system32\sc.exesc config Audiosrv start=auto2⤵
- Launches sc.exe
PID:1332
-
-
C:\Windows\system32\sc.exesc config AxInstSV start=demand2⤵PID:2472
-
-
C:\Windows\system32\sc.exesc config BDESVC start=demand2⤵PID:2560
-
-
C:\Windows\system32\sc.exesc config BFE start=auto2⤵PID:1388
-
-
C:\Windows\system32\sc.exesc config BITS start=delayed-auto2⤵PID:2132
-
-
C:\Windows\system32\sc.exesc config BTAGService start=demand2⤵PID:2808
-
-
C:\Windows\system32\sc.exesc config BcastDVRUserService_dc2a4 start=demand2⤵PID:2968
-
-
C:\Windows\system32\sc.exesc config BluetoothUserService_dc2a4 start=demand2⤵PID:1764
-
-
C:\Windows\system32\sc.exesc config BrokerInfrastructure start=auto2⤵
- Launches sc.exe
PID:1384
-
-
C:\Windows\system32\sc.exesc config Browser start=demand2⤵
- Launches sc.exe
PID:1824
-
-
C:\Windows\system32\sc.exesc config BthAvctpSvc start=auto2⤵PID:2008
-
-
C:\Windows\system32\sc.exesc config BthHFSrv start=auto2⤵PID:1992
-
-
C:\Windows\system32\sc.exesc config CDPSvc start=demand2⤵
- Launches sc.exe
PID:1036
-
-
C:\Windows\system32\sc.exesc config CDPUserSvc_dc2a4 start=auto2⤵PID:448
-
-
C:\Windows\system32\sc.exesc config COMSysApp start=demand2⤵PID:844
-
-
C:\Windows\system32\sc.exesc config CaptureService_dc2a4 start=demand2⤵PID:3016
-
-
C:\Windows\system32\sc.exesc config CertPropSvc start=demand2⤵PID:2604
-
-
C:\Windows\system32\sc.exesc config ClipSVC start=demand2⤵PID:1124
-
-
C:\Windows\system32\sc.exesc config ConsentUxUserSvc_dc2a4 start=demand2⤵PID:904
-
-
C:\Windows\system32\sc.exesc config CoreMessagingRegistrar start=auto2⤵
- Launches sc.exe
PID:912
-
-
C:\Windows\system32\sc.exesc config CredentialEnrollmentManagerUserSvc_dc2a4 start=demand2⤵PID:956
-
-
C:\Windows\system32\sc.exesc config CryptSvc start=auto2⤵PID:1352
-
-
C:\Windows\system32\sc.exesc config CscService start=demand2⤵PID:2464
-
-
C:\Windows\system32\sc.exesc config DPS start=auto2⤵
- Launches sc.exe
PID:2848
-
-
C:\Windows\system32\sc.exesc config DcomLaunch start=auto2⤵
- Launches sc.exe
PID:2188
-
-
C:\Windows\system32\sc.exesc config DcpSvc start=demand2⤵PID:1280
-
-
C:\Windows\system32\sc.exesc config DevQueryBroker start=demand2⤵PID:1828
-
-
C:\Windows\system32\sc.exesc config DeviceAssociationBrokerSvc_dc2a4 start=demand2⤵
- Launches sc.exe
PID:1056
-
-
C:\Windows\system32\sc.exesc config DeviceAssociationService start=demand2⤵PID:1636
-
-
C:\Windows\system32\sc.exesc config DeviceInstall start=demand2⤵PID:2504
-
-
C:\Windows\system32\sc.exesc config DevicePickerUserSvc_dc2a4 start=demand2⤵PID:2956
-
-
C:\Windows\system32\sc.exesc config DevicesFlowUserSvc_dc2a4 start=demand2⤵PID:1784
-
-
C:\Windows\system32\sc.exesc config Dhcp start=auto2⤵PID:1308
-
-
C:\Windows\system32\sc.exesc config DiagTrack start=disabled2⤵
- Launches sc.exe
PID:1260
-
-
C:\Windows\system32\sc.exesc config DialogBlockingService start=disabled2⤵PID:2352
-
-
C:\Windows\system32\sc.exesc config DispBrokerDesktopSvc start=auto2⤵PID:1304
-
-
C:\Windows\system32\sc.exesc config DisplayEnhancementService start=demand2⤵
- Launches sc.exe
PID:1804
-
-
C:\Windows\system32\sc.exesc config DmEnrollmentSvc start=demand2⤵PID:544
-
-
C:\Windows\system32\sc.exesc config Dnscache start=auto2⤵PID:924
-
-
C:\Windows\system32\sc.exesc config DoSvc start=delayed-auto2⤵PID:2312
-
-
C:\Windows\system32\sc.exesc config DsSvc start=demand2⤵PID:2348
-
-
C:\Windows\system32\sc.exesc config DsmSvc start=demand2⤵
- Launches sc.exe
PID:556
-
-
C:\Windows\system32\sc.exesc config DusmSvc start=auto2⤵PID:2480
-
-
C:\Windows\system32\sc.exesc config EFS start=demand2⤵PID:2996
-
-
C:\Windows\system32\sc.exesc config EapHost start=demand2⤵PID:920
-
-
C:\Windows\system32\sc.exesc config EntAppSvc start=demand2⤵PID:2412
-
-
C:\Windows\system32\sc.exesc config EventLog start=auto2⤵PID:1920
-
-
C:\Windows\system32\sc.exesc config EventSystem start=auto2⤵PID:828
-
-
C:\Windows\system32\sc.exesc config FDResPub start=demand2⤵PID:2000
-
-
C:\Windows\system32\sc.exesc config Fax start=demand2⤵PID:2108
-
-
C:\Windows\system32\sc.exesc config FontCache start=auto2⤵
- Launches sc.exe
PID:1640
-
-
C:\Windows\system32\sc.exesc config FrameServer start=demand2⤵PID:2992
-
-
C:\Windows\system32\sc.exesc config FrameServerMonitor start=demand2⤵PID:2112
-
-
C:\Windows\system32\sc.exesc config GraphicsPerfSvc start=demand2⤵PID:1268
-
-
C:\Windows\system32\sc.exesc config HomeGroupListener start=demand2⤵PID:1952
-
-
C:\Windows\system32\sc.exesc config HomeGroupProvider start=demand2⤵PID:468
-
-
C:\Windows\system32\sc.exesc config HvHost start=demand2⤵PID:884
-
-
C:\Windows\system32\sc.exesc config IEEtwCollectorService start=demand2⤵PID:1664
-
-
C:\Windows\system32\sc.exesc config IKEEXT start=demand2⤵PID:1028
-
-
C:\Windows\system32\sc.exesc config InstallService start=demand2⤵
- Launches sc.exe
PID:2364
-
-
C:\Windows\system32\sc.exesc config InventorySvc start=demand2⤵PID:1728
-
-
C:\Windows\system32\sc.exesc config IpxlatCfgSvc start=demand2⤵PID:1944
-
-
C:\Windows\system32\sc.exesc config KeyIso start=auto2⤵PID:1616
-
-
C:\Windows\system32\sc.exesc config KtmRm start=demand2⤵PID:2460
-
-
C:\Windows\system32\sc.exesc config LSM start=auto2⤵PID:1152
-
-
C:\Windows\system32\sc.exesc config LanmanServer start=auto2⤵PID:2436
-
-
C:\Windows\system32\sc.exesc config LanmanWorkstation start=auto2⤵PID:2540
-
-
C:\Windows\system32\sc.exesc config LicenseManager start=demand2⤵PID:2068
-
-
C:\Windows\system32\sc.exesc config LxpSvc start=demand2⤵PID:1724
-
-
C:\Windows\system32\sc.exesc config MSDTC start=demand2⤵PID:1264
-
-
C:\Windows\system32\sc.exesc config MSiSCSI start=demand2⤵PID:1712
-
-
C:\Windows\system32\sc.exesc config MapsBroker start=delayed-auto2⤵PID:2972
-
-
C:\Windows\system32\sc.exesc config McpManagementService start=demand2⤵
- Launches sc.exe
PID:668
-
-
C:\Windows\system32\sc.exesc config MessagingService_dc2a4 start=demand2⤵
- Launches sc.exe
PID:2716
-
-
C:\Windows\system32\sc.exesc config MicrosoftEdgeElevationService start=demand2⤵PID:2516
-
-
C:\Windows\system32\sc.exesc config MixedRealityOpenXRSvc start=demand2⤵PID:2864
-
-
C:\Windows\system32\sc.exesc config MpsSvc start=auto2⤵PID:3000
-
-
C:\Windows\system32\sc.exesc config MsKeyboardFilter start=demand2⤵PID:2756
-
-
C:\Windows\system32\sc.exesc config NPSMSvc_dc2a4 start=demand2⤵PID:2632
-
-
C:\Windows\system32\sc.exesc config NaturalAuthentication start=demand2⤵PID:2764
-
-
C:\Windows\system32\sc.exesc config NcaSvc start=demand2⤵PID:2776
-
-
C:\Windows\system32\sc.exesc config NcbService start=demand2⤵PID:2900
-
-
C:\Windows\system32\sc.exesc config NcdAutoSetup start=demand2⤵PID:2780
-
-
C:\Windows\system32\sc.exesc config NetSetupSvc start=demand2⤵PID:2196
-
-
C:\Windows\system32\sc.exesc config NetTcpPortSharing start=disabled2⤵PID:2804
-
-
C:\Windows\system32\sc.exesc config Netlogon start=demand2⤵PID:1572
-
-
C:\Windows\system32\sc.exesc config Netman start=demand2⤵
- Launches sc.exe
PID:2680
-
-
C:\Windows\system32\sc.exesc config NgcCtnrSvc start=demand2⤵PID:2888
-
-
C:\Windows\system32\sc.exesc config NgcSvc start=demand2⤵PID:2568
-
-
C:\Windows\system32\sc.exesc config NlaSvc start=demand2⤵
- Launches sc.exe
PID:2372
-
-
C:\Windows\system32\sc.exesc config OneSyncSvc_dc2a4 start=auto2⤵
- Launches sc.exe
PID:2476
-
-
C:\Windows\system32\sc.exesc config P9RdrService_dc2a4 start=demand2⤵PID:1708
-
-
C:\Windows\system32\sc.exesc config PNRPAutoReg start=demand2⤵PID:684
-
-
C:\Windows\system32\sc.exesc config PNRPsvc start=demand2⤵PID:1052
-
-
C:\Windows\system32\sc.exesc config PcaSvc start=demand2⤵PID:2636
-
-
C:\Windows\system32\sc.exesc config PeerDistSvc start=demand2⤵
- Launches sc.exe
PID:3044
-
-
C:\Windows\system32\sc.exesc config PenService_dc2a4 start=demand2⤵PID:2752
-
-
C:\Windows\system32\sc.exesc config PerfHost start=demand2⤵PID:1660
-
-
C:\Windows\system32\sc.exesc config PhoneSvc start=demand2⤵PID:2096
-
-
C:\Windows\system32\sc.exesc config PimIndexMaintenanceSvc_dc2a4 start=demand2⤵PID:2772
-
-
C:\Windows\system32\sc.exesc config PlugPlay start=demand2⤵PID:2840
-
-
C:\Windows\system32\sc.exesc config PolicyAgent start=demand2⤵
- Launches sc.exe
PID:1544
-
-
C:\Windows\system32\sc.exesc config Power start=auto2⤵
- Launches sc.exe
PID:1484
-
-
C:\Windows\system32\sc.exesc config PrintNotify start=demand2⤵PID:1320
-
-
C:\Windows\system32\sc.exesc config PrintWorkflowUserSvc_dc2a4 start=demand2⤵PID:2012
-
-
C:\Windows\system32\sc.exesc config ProfSvc start=auto2⤵PID:2596
-
-
C:\Windows\system32\sc.exesc config PushToInstall start=demand2⤵PID:1788
-
-
C:\Windows\system32\sc.exesc config QWAVE start=demand2⤵PID:2388
-
-
C:\Windows\system32\sc.exesc config RasAuto start=demand2⤵PID:2932
-
-
C:\Windows\system32\sc.exesc config RasMan start=demand2⤵PID:2712
-
-
C:\Windows\system32\sc.exesc config RemoteAccess start=disabled2⤵
- Launches sc.exe
PID:2660
-
-
C:\Windows\system32\sc.exesc config RemoteRegistry start=disabled2⤵PID:2928
-
-
C:\Windows\system32\sc.exesc config RetailDemo start=demand2⤵PID:2080
-
-
C:\Windows\system32\sc.exesc config RmSvc start=demand2⤵
- Launches sc.exe
PID:2852
-
-
C:\Windows\system32\sc.exesc config RpcEptMapper start=auto2⤵PID:1332
-
-
C:\Windows\system32\sc.exesc config RpcLocator start=demand2⤵PID:2472
-
-
C:\Windows\system32\sc.exesc config RpcSs start=auto2⤵PID:2560
-
-
C:\Windows\system32\sc.exesc config SCPolicySvc start=demand2⤵
- Launches sc.exe
PID:1388
-
-
C:\Windows\system32\sc.exesc config SCardSvr start=demand2⤵PID:2132
-
-
C:\Windows\system32\sc.exesc config SDRSVC start=demand2⤵PID:2160
-
-
C:\Windows\system32\sc.exesc config SEMgrSvc start=demand2⤵
- Launches sc.exe
PID:1520
-
-
C:\Windows\system32\sc.exesc config SENS start=auto2⤵PID:592
-
-
C:\Windows\system32\sc.exesc config SNMPTRAP start=demand2⤵PID:1084
-
-
C:\Windows\system32\sc.exesc config SNMPTrap start=demand2⤵
- Launches sc.exe
PID:1496
-
-
C:\Windows\system32\sc.exesc config SSDPSRV start=demand2⤵
- Launches sc.exe
PID:600
-
-
C:\Windows\system32\sc.exesc config SamSs start=auto2⤵PID:552
-
-
C:\Windows\system32\sc.exesc config ScDeviceEnum start=demand2⤵
- Launches sc.exe
PID:1700
-
-
C:\Windows\system32\sc.exesc config Schedule start=auto2⤵PID:408
-
-
C:\Windows\system32\sc.exesc config SecurityHealthService start=demand2⤵PID:1868
-
-
C:\Windows\system32\sc.exesc config Sense start=demand2⤵PID:3004
-
-
C:\Windows\system32\sc.exesc config SensorDataService start=demand2⤵
- Launches sc.exe
PID:2292
-
-
C:\Windows\system32\sc.exesc config SensorService start=demand2⤵PID:2608
-
-
C:\Windows\system32\sc.exesc config SensrSvc start=demand2⤵PID:616
-
-
C:\Windows\system32\sc.exesc config SessionEnv start=demand2⤵PID:1812
-
-
C:\Windows\system32\sc.exesc config SgrmBroker start=auto2⤵PID:1408
-
-
C:\Windows\system32\sc.exesc config SharedAccess start=demand2⤵PID:1672
-
-
C:\Windows\system32\sc.exesc config SharedRealitySvc start=demand2⤵PID:1648
-
-
C:\Windows\system32\sc.exesc config ShellHWDetection start=auto2⤵PID:264
-
-
C:\Windows\system32\sc.exesc config SmsRouter start=demand2⤵PID:532
-
-
C:\Windows\system32\sc.exesc config Spooler start=auto2⤵
- Launches sc.exe
PID:1156
-
-
C:\Windows\system32\sc.exesc config SstpSvc start=demand2⤵PID:1592
-
-
C:\Windows\system32\sc.exesc config StateRepository start=demand2⤵PID:2692
-
-
C:\Windows\system32\sc.exesc config StiSvc start=demand2⤵PID:1940
-
-
C:\Windows\system32\sc.exesc config StorSvc start=demand2⤵
- Launches sc.exe
PID:1400
-
-
C:\Windows\system32\sc.exesc config SysMain start=auto2⤵PID:1552
-
-
C:\Windows\system32\sc.exesc config SystemEventsBroker start=auto2⤵PID:1620
-
-
C:\Windows\system32\sc.exesc config TabletInputService start=demand2⤵PID:1288
-
-
C:\Windows\system32\sc.exesc config TapiSrv start=demand2⤵PID:1136
-
-
C:\Windows\system32\sc.exesc config TermService start=auto2⤵
- Launches sc.exe
PID:1040
-
-
C:\Windows\system32\sc.exesc config TextInputManagementService start=demand2⤵PID:1316
-
-
C:\Windows\system32\sc.exesc config Themes start=auto2⤵
- Launches sc.exe
PID:1556
-
-
C:\Windows\system32\sc.exesc config TieringEngineService start=demand2⤵
- Launches sc.exe
PID:1560
-
-
C:\Windows\system32\sc.exesc config TimeBroker start=demand2⤵PID:2252
-
-
C:\Windows\system32\sc.exesc config TimeBrokerSvc start=demand2⤵
- Launches sc.exe
PID:564
-
-
C:\Windows\system32\sc.exesc config TokenBroker start=demand2⤵PID:940
-
-
C:\Windows\system32\sc.exesc config TrkWks start=auto2⤵PID:1100
-
-
C:\Windows\system32\sc.exesc config TroubleshootingSvc start=demand2⤵PID:1628
-
-
C:\Windows\system32\sc.exesc config TrustedInstaller start=demand2⤵PID:760
-
-
C:\Windows\system32\sc.exesc config UI0Detect start=demand2⤵
- Launches sc.exe
PID:2244
-
-
C:\Windows\system32\sc.exesc config UdkUserSvc_dc2a4 start=demand2⤵PID:2316
-
-
C:\Windows\system32\sc.exesc config UevAgentService start=disabled2⤵
- Launches sc.exe
PID:1936
-
-
C:\Windows\system32\sc.exesc config UmRdpService start=demand2⤵
- Launches sc.exe
PID:2536
-
-
C:\Windows\system32\sc.exesc config UnistoreSvc_dc2a4 start=demand2⤵PID:2416
-
-
C:\Windows\system32\sc.exesc config UserDataSvc_dc2a4 start=demand2⤵PID:2324
-
-
C:\Windows\system32\sc.exesc config UserManager start=auto2⤵PID:2264
-
-
C:\Windows\system32\sc.exesc config UsoSvc start=demand2⤵PID:2032
-
-
C:\Windows\system32\sc.exesc config VGAuthService start=auto2⤵
- Launches sc.exe
PID:892
-
-
C:\Windows\system32\sc.exesc config VMTools start=auto2⤵PID:1000
-
-
C:\Windows\system32\sc.exesc config VSS start=demand2⤵PID:2208
-
-
C:\Windows\system32\sc.exesc config VacSvc start=demand2⤵
- Launches sc.exe
PID:2116
-
-
C:\Windows\system32\sc.exesc config VaultSvc start=auto2⤵PID:1508
-
-
C:\Windows\system32\sc.exesc config W32Time start=demand2⤵PID:1048
-
-
C:\Windows\system32\sc.exesc config WEPHOSTSVC start=demand2⤵PID:3020
-
-
C:\Windows\system32\sc.exesc config WFDSConMgrSvc start=demand2⤵PID:1728
-
-
C:\Windows\system32\sc.exesc config WMPNetworkSvc start=demand2⤵PID:1608
-
-
C:\Windows\system32\sc.exesc config WManSvc start=demand2⤵PID:2404
-
-
C:\Windows\system32\sc.exesc config WPDBusEnum start=demand2⤵PID:2428
-
-
C:\Windows\system32\sc.exesc config WSService start=demand2⤵PID:840
-
-
C:\Windows\system32\sc.exesc config WSearch start=delayed-auto2⤵PID:1792
-
-
C:\Windows\system32\sc.exesc config WaaSMedicSvc start=demand2⤵PID:2016
-
-
C:\Windows\system32\sc.exesc config WalletService start=demand2⤵PID:1744
-
-
C:\Windows\system32\sc.exesc config WarpJITSvc start=demand2⤵PID:1760
-
-
C:\Windows\system32\sc.exesc config WbioSrvc start=demand2⤵PID:2172
-
-
C:\Windows\system32\sc.exesc config Wcmsvc start=auto2⤵PID:2812
-
-
C:\Windows\system32\sc.exesc config WcsPlugInService start=demand2⤵
- Launches sc.exe
PID:2904
-
-
C:\Windows\system32\sc.exesc config WdNisSvc start=demand2⤵PID:2732
-
-
C:\Windows\system32\sc.exesc config WdiServiceHost start=demand2⤵PID:2856
-
-
C:\Windows\system32\sc.exesc config WdiSystemHost start=demand2⤵PID:2860
-
-
C:\Windows\system32\sc.exesc config WebClient start=demand2⤵PID:880
-
-
C:\Windows\system32\sc.exesc config Wecsvc start=demand2⤵
- Launches sc.exe
PID:2820
-
-
C:\Windows\system32\sc.exesc config WerSvc start=demand2⤵
- Launches sc.exe
PID:2740
-
-
C:\Windows\system32\sc.exesc config WiaRpc start=demand2⤵PID:2748
-
-
C:\Windows\system32\sc.exesc config WinDefend start=auto2⤵
- Launches sc.exe
PID:2236
-
-
C:\Windows\system32\sc.exesc config WinHttpAutoProxySvc start=demand2⤵PID:2828
-
-
C:\Windows\system32\sc.exesc config WinRM start=demand2⤵PID:2784
-
-
C:\Windows\system32\sc.exesc config Winmgmt start=auto2⤵
- Launches sc.exe
PID:2872
-
-
C:\Windows\system32\sc.exesc config WlanSvc start=auto2⤵PID:2508
-
-
C:\Windows\system32\sc.exesc config WpcMonSvc start=demand2⤵PID:2760
-
-
C:\Windows\system32\sc.exesc config WpnService start=demand2⤵PID:1224
-
-
C:\Windows\system32\sc.exesc config WpnUserService_dc2a4 start=auto2⤵PID:2736
-
-
C:\Windows\system32\sc.exesc config WwanSvc start=demand2⤵PID:2384
-
-
C:\Windows\system32\sc.exesc config XblAuthManager start=demand2⤵PID:3028
-
-
C:\Windows\system32\sc.exesc config XblGameSave start=demand2⤵
- Launches sc.exe
PID:2192
-
-
C:\Windows\system32\sc.exesc config XboxGipSvc start=demand2⤵PID:2688
-
-
C:\Windows\system32\sc.exesc config XboxNetApiSvc start=demand2⤵PID:2624
-
-
C:\Windows\system32\sc.exesc config autotimesvc start=demand2⤵PID:2644
-
-
C:\Windows\system32\sc.exesc config bthserv start=demand2⤵PID:2656
-
-
C:\Windows\system32\sc.exesc config camsvc start=demand2⤵PID:1752
-
-
C:\Windows\system32\sc.exesc config cbdhsvc_dc2a4 start=demand2⤵
- Launches sc.exe
PID:2672
-
-
C:\Windows\system32\sc.exesc config cloudidsvc start=demand2⤵PID:1960
-
-
C:\Windows\system32\sc.exesc config dcsvc start=demand2⤵PID:2344
-
-
C:\Windows\system32\sc.exesc config defragsvc start=demand2⤵PID:2832
-
-
C:\Windows\system32\sc.exesc config diagnosticshub.standardcollector.service start=demand2⤵
- Launches sc.exe
PID:856
-
-
C:\Windows\system32\sc.exesc config diagsvc start=demand2⤵PID:1020
-
-
C:\Windows\system32\sc.exesc config dmwappushservice start=demand2⤵PID:2684
-
-
C:\Windows\system32\sc.exesc config dot3svc start=demand2⤵PID:2376
-
-
C:\Windows\system32\sc.exesc config edgeupdate start=demand2⤵PID:380
-
-
C:\Windows\system32\sc.exesc config edgeupdatem start=demand2⤵PID:792
-
-
C:\Windows\system32\sc.exesc config embeddedmode start=demand2⤵
- Launches sc.exe
PID:1652
-
-
C:\Windows\system32\sc.exesc config fdPHost start=demand2⤵PID:2944
-
-
C:\Windows\system32\sc.exesc config fhsvc start=demand2⤵PID:2652
-
-
C:\Windows\system32\sc.exesc config gpsvc start=auto2⤵PID:2964
-
-
C:\Windows\system32\sc.exesc config hidserv start=demand2⤵PID:2664
-
-
C:\Windows\system32\sc.exesc config icssvc start=demand2⤵PID:2076
-
-
C:\Windows\system32\sc.exesc config iphlpsvc start=auto2⤵PID:2800
-
-
C:\Windows\system32\sc.exesc config lfsvc start=demand2⤵
- Launches sc.exe
PID:2128
-
-
C:\Windows\system32\sc.exesc config lltdsvc start=demand2⤵PID:2220
-
-
C:\Windows\system32\sc.exesc config lmhosts start=demand2⤵
- Launches sc.exe
PID:2072
-
-
C:\Windows\system32\sc.exesc config mpssvc start=auto2⤵PID:2548
-
-
C:\Windows\system32\sc.exesc config msiserver start=demand2⤵PID:1844
-
-
C:\Windows\system32\sc.exesc config netprofm start=demand2⤵PID:1580
-
-
C:\Windows\system32\sc.exesc config nsi start=auto2⤵PID:2948
-
-
C:\Windows\system32\sc.exesc config p2pimsvc start=demand2⤵PID:2968
-
-
C:\Windows\system32\sc.exesc config p2psvc start=demand2⤵PID:1764
-
-
C:\Windows\system32\sc.exesc config perceptionsimulation start=demand2⤵PID:964
-
-
C:\Windows\system32\sc.exesc config pla start=demand2⤵PID:1824
-
-
C:\Windows\system32\sc.exesc config seclogon start=demand2⤵
- Launches sc.exe
PID:568
-
-
C:\Windows\system32\sc.exesc config shpamsvc start=disabled2⤵PID:1992
-
-
C:\Windows\system32\sc.exesc config smphost start=demand2⤵PID:1036
-
-
C:\Windows\system32\sc.exesc config spectrum start=demand2⤵PID:1876
-
-
C:\Windows\system32\sc.exesc config sppsvc start=delayed-auto2⤵PID:844
-
-
C:\Windows\system32\sc.exesc config ssh-agent start=disabled2⤵PID:3016
-
-
C:\Windows\system32\sc.exesc config svsvc start=demand2⤵
- Launches sc.exe
PID:2604
-
-
C:\Windows\system32\sc.exesc config swprv start=demand2⤵PID:1124
-
-
C:\Windows\system32\sc.exesc config tiledatamodelsvc start=auto2⤵
- Launches sc.exe
PID:904
-
-
C:\Windows\system32\sc.exesc config tzautoupdate start=disabled2⤵PID:1272
-
-
C:\Windows\system32\sc.exesc config uhssvc start=disabled2⤵PID:956
-
-
C:\Windows\system32\sc.exesc config upnphost start=demand2⤵PID:1872
-
-
C:\Windows\system32\sc.exesc config vds start=demand2⤵
- Launches sc.exe
PID:2488
-
-
C:\Windows\system32\sc.exesc config vm3dservice start=demand2⤵PID:2848
-
-
C:\Windows\system32\sc.exesc config vmicguestinterface start=demand2⤵PID:2188
-
-
C:\Windows\system32\sc.exesc config vmicheartbeat start=demand2⤵PID:1280
-
-
C:\Windows\system32\sc.exesc config vmickvpexchange start=demand2⤵PID:1964
-
-
C:\Windows\system32\sc.exesc config vmicrdv start=demand2⤵PID:1740
-
-
C:\Windows\system32\sc.exesc config vmicshutdown start=demand2⤵PID:1636
-
-
C:\Windows\system32\sc.exesc config vmictimesync start=demand2⤵PID:1356
-
-
C:\Windows\system32\sc.exesc config vmicvmsession start=demand2⤵
- Launches sc.exe
PID:2956
-
-
C:\Windows\system32\sc.exesc config vmicvss start=demand2⤵PID:1784
-
-
C:\Windows\system32\sc.exesc config vmvss start=demand2⤵
- Launches sc.exe
PID:1308
-
-
C:\Windows\system32\sc.exesc config wbengine start=demand2⤵PID:1260
-
-
C:\Windows\system32\sc.exesc config wcncsvc start=demand2⤵
- Launches sc.exe
PID:2352
-
-
C:\Windows\system32\sc.exesc config webthreatdefsvc start=demand2⤵PID:1304
-
-
C:\Windows\system32\sc.exesc config webthreatdefusersvc_dc2a4 start=auto2⤵PID:1804
-
-
C:\Windows\system32\sc.exesc config wercplsupport start=demand2⤵
- Launches sc.exe
PID:908
-
-
C:\Windows\system32\sc.exesc config wisvc start=demand2⤵PID:2520
-
-
C:\Windows\system32\sc.exesc config wlidsvc start=demand2⤵PID:2312
-
-
C:\Windows\system32\sc.exesc config wlpasvc start=demand2⤵PID:1756
-
-
C:\Windows\system32\sc.exesc config wmiApSrv start=demand2⤵PID:556
-
-
C:\Windows\system32\sc.exesc config workfolderssvc start=demand2⤵
- Launches sc.exe
PID:2496
-
-
C:\Windows\system32\sc.exesc config wscsvc start=delayed-auto2⤵
- Launches sc.exe
PID:2996
-
-
C:\Windows\system32\sc.exesc config wuauserv start=demand2⤵PID:920
-
-
C:\Windows\system32\sc.exesc config wudfsvc start=demand2⤵PID:2392
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2408
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:1936
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable2⤵PID:2308
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable2⤵PID:2000
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable2⤵PID:2108
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable2⤵PID:1032
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable2⤵PID:2512
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable2⤵PID:2552
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable2⤵PID:1668
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable2⤵PID:2356
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable2⤵PID:1512
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\MareBackup" /Disable2⤵PID:884
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable2⤵PID:2140
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask" /Disable2⤵PID:936
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Maps\MapsUpdateTask" /Disable2⤵PID:3020
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f2⤵PID:932
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f2⤵PID:1944
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v ContentDeliveryAllowed /t REG_DWORD /d 0 /f2⤵PID:1612
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v OemPreInstalledAppsEnabled /t REG_DWORD /d 0 /f2⤵PID:1608
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v PreInstalledAppsEnabled /t REG_DWORD /d 0 /f2⤵PID:2460
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v PreInstalledAppsEverEnabled /t REG_DWORD /d 0 /f2⤵PID:1576
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SilentInstalledAppsEnabled /t REG_DWORD /d 0 /f2⤵PID:2428
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338387Enabled /t REG_DWORD /d 0 /f2⤵PID:2436
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338388Enabled /t REG_DWORD /d 0 /f2⤵PID:2180
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338389Enabled /t REG_DWORD /d 0 /f2⤵PID:1792
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-353698Enabled /t REG_DWORD /d 0 /f2⤵PID:2068
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SystemPaneSuggestionsEnabled /t REG_DWORD /d 0 /f2⤵PID:1924
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f2⤵PID:1744
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f2⤵PID:1264
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f2⤵PID:2400
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableTailoredExperiencesWithDiagnosticData /t REG_DWORD /d 1 /f2⤵PID:2172
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f2⤵PID:2904
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f2⤵PID:2716
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" /v DODownloadMode /t REG_DWORD /d 1 /f2⤵PID:2516
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp /t REG_DWORD /d 0 /f2⤵PID:2856
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager" /v EnthusiastMode /t REG_DWORD /d 1 /f2⤵PID:2868
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskViewButton /t REG_DWORD /d 0 /f2⤵PID:2892
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People" /v PeopleBand /t REG_DWORD /d 0 /f2⤵PID:880
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v LaunchTo /t REG_DWORD /d 1 /f2⤵PID:2756
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f2⤵PID:2328
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v SearchOrderConfig /t REG_DWORD /d 1 /f2⤵PID:2740
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness /t REG_DWORD /d 0 /f2⤵PID:2764
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex /t REG_DWORD /d 4294967295 /f2⤵PID:2988
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v MenuShowDelay /t REG_DWORD /d 1 /f2⤵PID:2236
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_DWORD /d 1 /f2⤵PID:2900
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v ClearPageFileAtShutdown /t REG_DWORD /d 0 /f2⤵PID:2780
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\ControlSet001\Services\Ndu" /v Start /t REG_DWORD /d 2 /f2⤵PID:2784
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Mouse" /v MouseHoverTime /t REG_SZ /d 400 /f2⤵PID:2196
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v IRPStackSize /t REG_DWORD /d 30 /f2⤵PID:2200
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds" /v EnableFeeds /t REG_DWORD /d 0 /f2⤵PID:2508
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Feeds" /v ShellFeedsTaskbarViewMode /t REG_DWORD /d 2 /f2⤵PID:2620
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideSCAMeetNow /t REG_DWORD /d 1 /f2⤵PID:1948
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority" /t REG_DWORD /d 8 /f2⤵PID:2680
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v Priority /t REG_DWORD /d 6 /f2⤵PID:2888
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Scheduling Category" /t REG_SZ /d High /f2⤵PID:2736
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement" /v "ScoobeSystemSettingEnabled" /t REG_DWORD /d 0 /f2⤵PID:952
-
-
C:\Windows\system32\timeout.exetimeout 12⤵
- Delays execution with timeout.exe
PID:2372
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootmenupolicy Legacy2⤵
- Modifies boot configuration data using bcdedit
PID:3028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild 2>nul | findstr /r /c:"CurrentBuild"2⤵PID:2476
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild3⤵PID:1708
-
-
C:\Windows\system32\findstr.exefindstr /r /c:"CurrentBuild"3⤵PID:2688
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Start-Process taskmgr.exe -WindowStyle Hidden"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:2772
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2152
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:792
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1788
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2792
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2944
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2932
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2712
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2964
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2660
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2916
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2076
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2940
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2296
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2128
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1332
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:860
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2072
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2560
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1388
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1844
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2132
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2160
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2948
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1520
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2612
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1764
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1384
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1496
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1824
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:600
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1800
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1992
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1856
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:448
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1876
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3008
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:3012
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3016
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2604
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2028
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2380
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:904
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:912
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:688
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:956
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1672
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1648
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2488
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:2164
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1836
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1156
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1592
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1964
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1056
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1940
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2504
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1356
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1552
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1864
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1784
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1288
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1136
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1260
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1040
-
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences2⤵PID:1316
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1304
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005AC" "00000000000003CC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2800
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD51f20a7451e4145d92ea675370ef5e471
SHA1713465f699c4e476335742398e4a0867d9b51eeb
SHA256dac524b722f4edee1de69b75feff45c0de9e0b1ff204bac12eb04eefe64eaf0a
SHA512682029c1ac9b46a4972a99609935468dd2970f8a50e60a0aff7156e401f5a4b821f51f1a63a1d76cf24154d951c656d8a01fc103d2964eb480e1f6429977f877
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NBILZ6KEZGAY4E5DUVT5.temp
Filesize7KB
MD5e3807e4981d2bf852ed8cba6e598dd8a
SHA1aff10f2aa3f1842032a9ac12722f65d4ccfa3fc6
SHA2565a848e32adaa4448751365f812150b98150538389da11912f33bad2a583c4faf
SHA51204d2a5c844810be4c8e102d3abdc2e6ea5d82255186a5dd76947141c59e4c6d4552d93e432973e0d1dee9cf83387ac5c6487aaba418527dcc2154b34275df1c4