439ff2060a600d666dafcf86f7ef8fea5ee0cca7e39521c986a3181d99ede61d

Resubmissions

01/07/2025, 07:25

250701-h9bw6asry710

06/11/2024, 02:31

241106-cztrbstepk10

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/11/2024, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
key_gen/ransom.exe
Size 6.4MB
Sample241106-cztrbstepk
SHA256 1363c8871061ff83ed3dd0fe025b274442d5c30898c02bdfd4981717f4f33b44
MD5 38fb9ac2e51d04182faf81afbef08ab8
SHA1 1f325950a7a8e1a2050e954f33d2c3774510bd6e
SHA512 8af5062d6d133379b0ad87439cdf99fc98bff266f03c0a831f84c0c41224c7a97e8e0a5583e8d4b24c04edd0bc6099646ebea3388ffe2fe7917b709604e63406
SSDEEP 6144:iODh8y70MgJ+j2ZsKmj82uGBOOGHO0GL2g6VzxazESJx2sYMLoI4H4voKJ+QtDeJ:ik70MZMc0RdQtzH8lhwFbZgaOm
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	ransom.exe
File opened for modification	\??\f:\$RECYCLE.BIN\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	ransom.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	ransom.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	ransom.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	ransom.exe
File opened (read-only)	\??\l:	ransom.exe
File opened (read-only)	\??\m:	ransom.exe
File opened (read-only)	\??\s:	ransom.exe
File opened (read-only)	\??\u:	ransom.exe
File opened (read-only)	\??\z:	ransom.exe
File opened (read-only)	\??\e:	ransom.exe
File opened (read-only)	\??\o:	ransom.exe
File opened (read-only)	\??\p:	ransom.exe
File opened (read-only)	\??\q:	ransom.exe
File opened (read-only)	\??\t:	ransom.exe
File opened (read-only)	\??\w:	ransom.exe
File opened (read-only)	\??\y:	ransom.exe
File opened (read-only)	\??\i:	ransom.exe
File opened (read-only)	\??\h:	ransom.exe
File opened (read-only)	\??\j:	ransom.exe
File opened (read-only)	\??\v:	ransom.exe
File opened (read-only)	\??\b:	ransom.exe
File opened (read-only)	\??\k:	ransom.exe
File opened (read-only)	\??\n:	ransom.exe
File opened (read-only)	\??\r:	ransom.exe
File opened (read-only)	\??\x:	ransom.exe
File opened (read-only)	\??\a:	ransom.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\tmp.bmp"	ransom.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ransom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
2772	taskkill.exe
3000	taskkill.exe
2556	taskkill.exe
2176	taskkill.exe
2504	taskkill.exe
1148	taskkill.exe
1592	taskkill.exe
1816	taskkill.exe
980	taskkill.exe
2468	taskkill.exe
2648	taskkill.exe
2056	taskkill.exe
1676	taskkill.exe
2112	taskkill.exe
688	taskkill.exe
1696	taskkill.exe
740	taskkill.exe
2696	taskkill.exe
1684	taskkill.exe
2100	taskkill.exe
568	taskkill.exe
2760	taskkill.exe
2636	taskkill.exe
1556	taskkill.exe
2696	taskkill.exe
2644	taskkill.exe
2260	taskkill.exe
2868	taskkill.exe
1820	taskkill.exe
2044	taskkill.exe
1264	taskkill.exe
1284	taskkill.exe
2732	taskkill.exe
1196	taskkill.exe
868	taskkill.exe
1056	taskkill.exe
556	taskkill.exe
1288	taskkill.exe
2664	taskkill.exe
2184	taskkill.exe
1028	taskkill.exe
2656	taskkill.exe
2920	taskkill.exe
2184	taskkill.exe
2392	taskkill.exe
1052	taskkill.exe
1724	taskkill.exe
2232	taskkill.exe
2276	taskkill.exe
316	taskkill.exe
900	taskkill.exe
1088	taskkill.exe
2076	taskkill.exe
2504	taskkill.exe
1052	taskkill.exe
1608	taskkill.exe
1508	taskkill.exe
604	taskkill.exe
2800	taskkill.exe
2052	taskkill.exe
836	taskkill.exe
2292	taskkill.exe
2880	taskkill.exe
2284	taskkill.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	3068	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	948	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	2176	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	1868	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	568	taskkill.exe
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	2904	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	1196	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	1288	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeDebugPrivilege	2056	taskkill.exe
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeDebugPrivilege	2996	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	912	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	2504	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	2644	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	900	taskkill.exe
Token: SeDebugPrivilege	868	taskkill.exe
Token: SeDebugPrivilege	236	taskkill.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	1276	taskkill.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	2992	taskkill.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1440	1728	ransom.exe	32
PID 1728 wrote to memory of 1440	1728	ransom.exe	32
PID 1728 wrote to memory of 1440	1728	ransom.exe	32
PID 1728 wrote to memory of 1440	1728	ransom.exe	32
PID 1440 wrote to memory of 2276	1440	cmd.exe	33
PID 1440 wrote to memory of 2276	1440	cmd.exe	33
PID 1440 wrote to memory of 2276	1440	cmd.exe	33
PID 1440 wrote to memory of 2276	1440	cmd.exe	33
PID 1728 wrote to memory of 2680	1728	ransom.exe	35
PID 1728 wrote to memory of 2680	1728	ransom.exe	35
PID 1728 wrote to memory of 2680	1728	ransom.exe	35
PID 1728 wrote to memory of 2680	1728	ransom.exe	35
PID 2680 wrote to memory of 2944	2680	cmd.exe	36
PID 2680 wrote to memory of 2944	2680	cmd.exe	36
PID 2680 wrote to memory of 2944	2680	cmd.exe	36
PID 2680 wrote to memory of 2944	2680	cmd.exe	36
PID 1728 wrote to memory of 1036	1728	ransom.exe	38
PID 1728 wrote to memory of 1036	1728	ransom.exe	38
PID 1728 wrote to memory of 1036	1728	ransom.exe	38
PID 1728 wrote to memory of 1036	1728	ransom.exe	38
PID 1036 wrote to memory of 1328	1036	cmd.exe	39
PID 1036 wrote to memory of 1328	1036	cmd.exe	39
PID 1036 wrote to memory of 1328	1036	cmd.exe	39
PID 1036 wrote to memory of 1328	1036	cmd.exe	39
PID 1728 wrote to memory of 2164	1728	ransom.exe	40
PID 1728 wrote to memory of 2164	1728	ransom.exe	40
PID 1728 wrote to memory of 2164	1728	ransom.exe	40
PID 1728 wrote to memory of 2164	1728	ransom.exe	40
PID 2164 wrote to memory of 3068	2164	cmd.exe	41
PID 2164 wrote to memory of 3068	2164	cmd.exe	41
PID 2164 wrote to memory of 3068	2164	cmd.exe	41
PID 2164 wrote to memory of 3068	2164	cmd.exe	41
PID 1728 wrote to memory of 1256	1728	ransom.exe	42
PID 1728 wrote to memory of 1256	1728	ransom.exe	42
PID 1728 wrote to memory of 1256	1728	ransom.exe	42
PID 1728 wrote to memory of 1256	1728	ransom.exe	42
PID 1256 wrote to memory of 1252	1256	cmd.exe	43
PID 1256 wrote to memory of 1252	1256	cmd.exe	43
PID 1256 wrote to memory of 1252	1256	cmd.exe	43
PID 1256 wrote to memory of 1252	1256	cmd.exe	43
PID 1728 wrote to memory of 2580	1728	ransom.exe	44
PID 1728 wrote to memory of 2580	1728	ransom.exe	44
PID 1728 wrote to memory of 2580	1728	ransom.exe	44
PID 1728 wrote to memory of 2580	1728	ransom.exe	44
PID 2580 wrote to memory of 948	2580	cmd.exe	45
PID 2580 wrote to memory of 948	2580	cmd.exe	45
PID 2580 wrote to memory of 948	2580	cmd.exe	45
PID 2580 wrote to memory of 948	2580	cmd.exe	45
PID 1728 wrote to memory of 292	1728	ransom.exe	46
PID 1728 wrote to memory of 292	1728	ransom.exe	46
PID 1728 wrote to memory of 292	1728	ransom.exe	46
PID 1728 wrote to memory of 292	1728	ransom.exe	46
PID 292 wrote to memory of 1716	292	cmd.exe	47
PID 292 wrote to memory of 1716	292	cmd.exe	47
PID 292 wrote to memory of 1716	292	cmd.exe	47
PID 292 wrote to memory of 1716	292	cmd.exe	47
PID 1728 wrote to memory of 2992	1728	ransom.exe	48
PID 1728 wrote to memory of 2992	1728	ransom.exe	48
PID 1728 wrote to memory of 2992	1728	ransom.exe	48
PID 1728 wrote to memory of 2992	1728	ransom.exe	48
PID 2992 wrote to memory of 2176	2992	cmd.exe	49
PID 2992 wrote to memory of 2176	2992	cmd.exe	49
PID 2992 wrote to memory of 2176	2992	cmd.exe	49
PID 2992 wrote to memory of 2176	2992	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\key_gen\ransom.exe
"C:\Users\Admin\AppData\Local\Temp\key_gen\ransom.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - Kills process with taskkill
    PID:1508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:1084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    PID:1432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  PID:880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mmc.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mmc.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact