amadey | c5c376615760a2511b3144d811e1f7ce71f0b7f869e38786e0bb8363f69daba4

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	49f47e310b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	49f47e310b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	49f47e310b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	49f47e310b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	49f47e310b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	49f47e310b.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	20cb909963.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	49f47e310b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ff901f03ec.exe

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/3488-852-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-857-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-856-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-855-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-854-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-853-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-851-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-866-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-868-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/3488-869-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	49f47e310b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ff901f03ec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ff901f03ec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	20cb909963.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	20cb909963.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	49f47e310b.exe

Executes dropped EXE 23 IoCs

pid	Process
2284	skotes.exe
1908	9JTVo50.exe
1852	WkfyDiO.exe
572	e808c3bb81.exe
1656	a7538e3b03.exe
1352	20cb909963.exe
3760	49f47e310b.exe
3168	f2bee66f8d.exe
2692	ff901f03ec.exe
1436	9ef2e23859.exe
3900	7z.exe
3512	7z.exe
3712	7z.exe
3972	7z.exe
4036	7z.exe
3196	7z.exe
3092	7z.exe
1568	7z.exe
3232	e413ee25e4.exe
3324	in.exe
3764	e413ee25e4.exe
3360	e413ee25e4.exe
3372	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	49f47e310b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	ff901f03ec.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	20cb909963.exe

Loads dropped DLL 45 IoCs

pid	Process
2508	file.exe
2284	skotes.exe
2284	skotes.exe
1852	WkfyDiO.exe
2284	skotes.exe
2284	skotes.exe
2284	skotes.exe
760	WerFault.exe
760	WerFault.exe
760	WerFault.exe
760	WerFault.exe
760	WerFault.exe
2284	skotes.exe
2284	skotes.exe
2284	skotes.exe
2284	skotes.exe
2284	skotes.exe
2284	skotes.exe
2284	skotes.exe
2284	skotes.exe
3828	cmd.exe
3900	7z.exe
3828	cmd.exe
3512	7z.exe
3828	cmd.exe
3712	7z.exe
3828	cmd.exe
3972	7z.exe
3828	cmd.exe
4036	7z.exe
3828	cmd.exe
3196	7z.exe
3828	cmd.exe
3092	7z.exe
3828	cmd.exe
1568	7z.exe
2284	skotes.exe
2284	skotes.exe
3828	cmd.exe
3828	cmd.exe
3232	e413ee25e4.exe
3232	e413ee25e4.exe
2692	ff901f03ec.exe
3568	taskeng.exe
3568	taskeng.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	49f47e310b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	49f47e310b.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\20cb909963.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014719001\\20cb909963.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\49f47e310b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014720001\\49f47e310b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\a7538e3b03.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014718001\\a7538e3b03.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0005000000019589-220.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
1684	tasklist.exe
3500	tasklist.exe
3620	tasklist.exe
3912	tasklist.exe
3960	tasklist.exe
1064	tasklist.exe
3660	tasklist.exe
3672	tasklist.exe
3384	tasklist.exe
3080	tasklist.exe
3944	tasklist.exe
3288	tasklist.exe
1888	tasklist.exe
3944	tasklist.exe
3768	tasklist.exe
3804	tasklist.exe
3292	tasklist.exe
1356	tasklist.exe
3972	tasklist.exe
2220	tasklist.exe
3988	tasklist.exe
2232	tasklist.exe
3712	tasklist.exe
3684	tasklist.exe
3992	tasklist.exe
4092	tasklist.exe
3244	tasklist.exe
3604	tasklist.exe
3968	tasklist.exe
2920	tasklist.exe
3820	tasklist.exe
3528	tasklist.exe
320	tasklist.exe
3448	tasklist.exe
3796	tasklist.exe
1252	tasklist.exe
2280	tasklist.exe
3588	tasklist.exe
3812	tasklist.exe
3656	tasklist.exe
3224	tasklist.exe
3944	tasklist.exe
3260	tasklist.exe
3864	tasklist.exe
3432	tasklist.exe
3508	tasklist.exe
3744	tasklist.exe
3588	tasklist.exe
3672	tasklist.exe
2504	tasklist.exe
3548	tasklist.exe
3364	tasklist.exe
3944	tasklist.exe
1564	tasklist.exe
3432	tasklist.exe
3088	tasklist.exe
3756	tasklist.exe
3972	tasklist.exe
1428	tasklist.exe
3916	tasklist.exe
2760	tasklist.exe
3864	tasklist.exe
3804	tasklist.exe
3100	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2508	file.exe
2284	skotes.exe
1352	20cb909963.exe
3760	49f47e310b.exe
2692	ff901f03ec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3232 set thread context of 3360	3232	e413ee25e4.exe	228
PID 3372 set thread context of 3488	3372	Intel_PTT_EK_Recertification.exe	375

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3324-776-0x000000013F8E0000-0x000000013FD70000-memory.dmp	upx
behavioral1/memory/3568-847-0x000000013F350000-0x000000013F7E0000-memory.dmp	upx
behavioral1/memory/3372-848-0x000000013F350000-0x000000013F7E0000-memory.dmp	upx
behavioral1/memory/3372-859-0x000000013F350000-0x000000013F7E0000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
760	1908	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e808c3bb81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e413ee25e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	a7538e3b03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49f47e310b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ef2e23859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7538e3b03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	a7538e3b03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9JTVo50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20cb909963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2bee66f8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff901f03ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e413ee25e4.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3288	powershell.exe
3516	PING.EXE
3352	powershell.exe
3880	PING.EXE

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	e808c3bb81.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e808c3bb81.exe

Delays execution with timeout.exe 64 IoCs

pid	Process
3708	timeout.exe
4080	timeout.exe
3352	timeout.exe
3748	timeout.exe
3312	timeout.exe
3380	timeout.exe
1104	timeout.exe
2984	timeout.exe
3944	timeout.exe
3440	timeout.exe
3704	timeout.exe
3144	timeout.exe
4064	timeout.exe
3584	timeout.exe
3640	timeout.exe
4072	timeout.exe
1844	timeout.exe
3780	timeout.exe
3440	timeout.exe
3724	timeout.exe
3232	timeout.exe
3532	timeout.exe
3316	timeout.exe
2220	timeout.exe
1428	timeout.exe
4092	timeout.exe
3220	timeout.exe
3668	timeout.exe
1664	timeout.exe
1564	timeout.exe
3700	timeout.exe
3348	timeout.exe
2412	timeout.exe
2316	timeout.exe
816	timeout.exe
4040	timeout.exe
2920	timeout.exe
3776	timeout.exe
552	timeout.exe
3128	timeout.exe
3484	timeout.exe
956	timeout.exe
3896	timeout.exe
2384	timeout.exe
2540	timeout.exe
3444	timeout.exe
3912	timeout.exe
3284	timeout.exe
3788	timeout.exe
3440	timeout.exe
3296	timeout.exe
3084	timeout.exe
3240	timeout.exe
3200	timeout.exe
3392	timeout.exe
3708	timeout.exe
3816	timeout.exe
4052	timeout.exe
3420	timeout.exe
2320	timeout.exe
3124	timeout.exe
3976	timeout.exe
4076	timeout.exe
3536	timeout.exe

Kills process with taskkill 5 IoCs

pid	Process
2000	taskkill.exe
1352	taskkill.exe
2024	taskkill.exe
2920	taskkill.exe
1884	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	e808c3bb81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	e413ee25e4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	e413ee25e4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	e808c3bb81.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	e808c3bb81.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3516	PING.EXE
3880	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2508	file.exe
2284	skotes.exe
1852	WkfyDiO.exe
1852	WkfyDiO.exe
1852	WkfyDiO.exe
572	e808c3bb81.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1352	20cb909963.exe
1352	20cb909963.exe
3760	49f47e310b.exe
3760	49f47e310b.exe
3760	49f47e310b.exe
3760	49f47e310b.exe
2692	ff901f03ec.exe
2692	ff901f03ec.exe
3288	powershell.exe
3372	Intel_PTT_EK_Recertification.exe
3352	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	WkfyDiO.exe
Token: SeDebugPrivilege	2064	tasklist.exe
Token: SeDebugPrivilege	320	tasklist.exe
Token: SeDebugPrivilege	2480	tasklist.exe
Token: SeDebugPrivilege	1356	tasklist.exe
Token: SeDebugPrivilege	1428	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	2768	tasklist.exe
Token: SeDebugPrivilege	2652	tasklist.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	2556	tasklist.exe
Token: SeDebugPrivilege	1376	tasklist.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	2504	tasklist.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	2296	tasklist.exe
Token: SeDebugPrivilege	2320	firefox.exe
Token: SeDebugPrivilege	2320	firefox.exe
Token: SeDebugPrivilege	1016	tasklist.exe
Token: SeDebugPrivilege	2920	tasklist.exe
Token: SeDebugPrivilege	1684	tasklist.exe
Token: SeDebugPrivilege	3224	tasklist.exe
Token: SeDebugPrivilege	3308	tasklist.exe
Token: SeDebugPrivilege	3356	tasklist.exe
Token: SeDebugPrivilege	3404	tasklist.exe
Token: SeDebugPrivilege	3448	tasklist.exe
Token: SeDebugPrivilege	3500	tasklist.exe
Token: SeDebugPrivilege	3548	tasklist.exe
Token: SeDebugPrivilege	3620	tasklist.exe
Token: SeDebugPrivilege	3672	tasklist.exe
Token: SeDebugPrivilege	3944	tasklist.exe
Token: SeDebugPrivilege	3992	tasklist.exe
Token: SeDebugPrivilege	3760	49f47e310b.exe
Token: SeDebugPrivilege	4044	tasklist.exe
Token: SeDebugPrivilege	4092	tasklist.exe
Token: SeDebugPrivilege	3084	tasklist.exe
Token: SeDebugPrivilege	2220	tasklist.exe
Token: SeDebugPrivilege	3220	tasklist.exe
Token: SeDebugPrivilege	3260	tasklist.exe
Token: SeDebugPrivilege	3384	tasklist.exe
Token: SeDebugPrivilege	3432	tasklist.exe
Token: SeDebugPrivilege	3604	tasklist.exe
Token: SeDebugPrivilege	3620	tasklist.exe
Token: SeDebugPrivilege	3688	tasklist.exe
Token: SeDebugPrivilege	3744	tasklist.exe
Token: SeDebugPrivilege	3916	tasklist.exe
Token: SeDebugPrivilege	3968	tasklist.exe
Token: SeDebugPrivilege	3988	tasklist.exe
Token: SeDebugPrivilege	3080	tasklist.exe
Token: SeRestorePrivilege	3900	7z.exe
Token: 35	3900	7z.exe
Token: SeSecurityPrivilege	3900	7z.exe
Token: SeSecurityPrivilege	3900	7z.exe
Token: SeRestorePrivilege	3512	7z.exe
Token: 35	3512	7z.exe
Token: SeSecurityPrivilege	3512	7z.exe
Token: SeSecurityPrivilege	3512	7z.exe
Token: SeRestorePrivilege	3712	7z.exe
Token: 35	3712	7z.exe
Token: SeSecurityPrivilege	3712	7z.exe
Token: SeSecurityPrivilege	3712	7z.exe
Token: SeDebugPrivilege	3768	tasklist.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2508	file.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
2320	firefox.exe
2320	firefox.exe
2320	firefox.exe
2320	firefox.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
2320	firefox.exe
2320	firefox.exe
2320	firefox.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe
1656	a7538e3b03.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2284	2508	file.exe	30
PID 2508 wrote to memory of 2284	2508	file.exe	30
PID 2508 wrote to memory of 2284	2508	file.exe	30
PID 2508 wrote to memory of 2284	2508	file.exe	30
PID 2284 wrote to memory of 1908	2284	skotes.exe	32
PID 2284 wrote to memory of 1908	2284	skotes.exe	32
PID 2284 wrote to memory of 1908	2284	skotes.exe	32
PID 2284 wrote to memory of 1908	2284	skotes.exe	32
PID 2284 wrote to memory of 1852	2284	skotes.exe	33
PID 2284 wrote to memory of 1852	2284	skotes.exe	33
PID 2284 wrote to memory of 1852	2284	skotes.exe	33
PID 2284 wrote to memory of 1852	2284	skotes.exe	33
PID 1852 wrote to memory of 2576	1852	WkfyDiO.exe	34
PID 1852 wrote to memory of 2576	1852	WkfyDiO.exe	34
PID 1852 wrote to memory of 2576	1852	WkfyDiO.exe	34
PID 2576 wrote to memory of 1432	2576	cmd.exe	36
PID 2576 wrote to memory of 1432	2576	cmd.exe	36
PID 2576 wrote to memory of 1432	2576	cmd.exe	36
PID 2576 wrote to memory of 2064	2576	cmd.exe	37
PID 2576 wrote to memory of 2064	2576	cmd.exe	37
PID 2576 wrote to memory of 2064	2576	cmd.exe	37
PID 2576 wrote to memory of 1436	2576	cmd.exe	38
PID 2576 wrote to memory of 1436	2576	cmd.exe	38
PID 2576 wrote to memory of 1436	2576	cmd.exe	38
PID 2576 wrote to memory of 2212	2576	cmd.exe	40
PID 2576 wrote to memory of 2212	2576	cmd.exe	40
PID 2576 wrote to memory of 2212	2576	cmd.exe	40
PID 2576 wrote to memory of 320	2576	cmd.exe	42
PID 2576 wrote to memory of 320	2576	cmd.exe	42
PID 2576 wrote to memory of 320	2576	cmd.exe	42
PID 2576 wrote to memory of 2020	2576	cmd.exe	43
PID 2576 wrote to memory of 2020	2576	cmd.exe	43
PID 2576 wrote to memory of 2020	2576	cmd.exe	43
PID 2576 wrote to memory of 552	2576	cmd.exe	44
PID 2576 wrote to memory of 552	2576	cmd.exe	44
PID 2576 wrote to memory of 552	2576	cmd.exe	44
PID 2284 wrote to memory of 572	2284	skotes.exe	45
PID 2284 wrote to memory of 572	2284	skotes.exe	45
PID 2284 wrote to memory of 572	2284	skotes.exe	45
PID 2284 wrote to memory of 572	2284	skotes.exe	45
PID 2576 wrote to memory of 2480	2576	cmd.exe	46
PID 2576 wrote to memory of 2480	2576	cmd.exe	46
PID 2576 wrote to memory of 2480	2576	cmd.exe	46
PID 2576 wrote to memory of 844	2576	cmd.exe	47
PID 2576 wrote to memory of 844	2576	cmd.exe	47
PID 2576 wrote to memory of 844	2576	cmd.exe	47
PID 2576 wrote to memory of 2956	2576	cmd.exe	48
PID 2576 wrote to memory of 2956	2576	cmd.exe	48
PID 2576 wrote to memory of 2956	2576	cmd.exe	48
PID 2576 wrote to memory of 1356	2576	cmd.exe	49
PID 2576 wrote to memory of 1356	2576	cmd.exe	49
PID 2576 wrote to memory of 1356	2576	cmd.exe	49
PID 2576 wrote to memory of 912	2576	cmd.exe	50
PID 2576 wrote to memory of 912	2576	cmd.exe	50
PID 2576 wrote to memory of 912	2576	cmd.exe	50
PID 2576 wrote to memory of 1564	2576	cmd.exe	51
PID 2576 wrote to memory of 1564	2576	cmd.exe	51
PID 2576 wrote to memory of 1564	2576	cmd.exe	51
PID 2576 wrote to memory of 1428	2576	cmd.exe	52
PID 2576 wrote to memory of 1428	2576	cmd.exe	52
PID 2576 wrote to memory of 1428	2576	cmd.exe	52
PID 2576 wrote to memory of 2104	2576	cmd.exe	53
PID 2576 wrote to memory of 2104	2576	cmd.exe	53
PID 2576 wrote to memory of 2104	2576	cmd.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
3224	attrib.exe
3364	attrib.exe
3348	attrib.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\1014564001\9JTVo50.exe
    "C:\Users\Admin\AppData\Local\Temp\1014564001\9JTVo50.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 44
      4⤵
      Loads dropped DLL
      Program crash
      PID:760
- - C:\Users\Admin\AppData\Local\Temp\1014611001\WkfyDiO.exe
    "C:\Users\Admin\AppData\Local\Temp\1014611001\WkfyDiO.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC523.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpC523.tmp.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1432
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1436
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2212
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2020
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:552
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:844
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2956
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:912
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1564
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2104
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2320
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2004
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2316
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2708
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2476
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1240
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2384
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1272
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1104
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1376
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1740
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2984
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2924
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2516
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:568
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2220
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2920
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2220
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2608
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2220
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1848
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1428
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3224
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3232
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3260
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3308
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3316
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3344
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3356
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3364
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3392
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3412
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3440
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3448
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3456
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3484
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3500
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3508
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3536
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3556
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3584
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3628
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3656
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3672
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3680
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3708
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3952
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3984
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3992
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4000
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:4028
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4052
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4080
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1848
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2608
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3092
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3120
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3256
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3224
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3276
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3304
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3260
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3336
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3316
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3384
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3360
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3352
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3424
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3440
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3604
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1240
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3640
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3628
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3700
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3688
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3684
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3736
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3732
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:816
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3912
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3708
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3964
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3936
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4024
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:4000
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3132
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3384
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3768
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3776
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1172
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3820
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3188
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3440
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3680
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3676
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3780
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3944
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3712
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2416
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3912
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4020
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:4024
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:4072
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3096
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3916
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3768
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3196
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3148
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:2232
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3200
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3124
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3244
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3252
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3296
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3336
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3236
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3144
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:4056
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3468
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3348
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3604
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3452
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3816
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3896
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3376
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3908
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3864
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3820
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3232
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3588
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3616
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3628
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3812
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3760
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3788
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3684
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3692
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3128
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3748
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3980
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2472
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3968
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3944
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3636
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3796
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4008
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3928
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3432
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3476
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4052
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3288
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1756
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:4024
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3920
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3940
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4092
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3088
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3776
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1844
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3528
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3932
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2224
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3804
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3152
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1428
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:2760
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3124
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3240
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3112
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3204
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3220
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3132
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3396
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:4084
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3604
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3452
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1632
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3480
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3880
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4064
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3864
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3820
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3444
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3608
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3384
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3664
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3672
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3612
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3420
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3508
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3788
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3684
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3736
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3128
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3748
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3960
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2472
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3532
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3944
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3636
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3912
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3972
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3516
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3344
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3476
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4080
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:876
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3700
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4068
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:4072
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3920
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3940
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:936
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:2280
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3196
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2412
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3648
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2368
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3592
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3528
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3932
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3156
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3164
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2612
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3976
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:1252
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2828
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3312
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3336
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3112
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3316
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3364
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3388
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1888
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:1064
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1664
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3572
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:2692
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3348
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2424
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3232
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3640
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3444
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3656
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3696
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2540
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3732
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3360
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3668
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3756
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2428
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3772
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3736
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3128
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2416
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3964
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2472
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3484
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3944
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3636
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3208
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:2096
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3972
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2376
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3876
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4080
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:4088
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3292
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3288
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:956
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:1564
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4004
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3084
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:2280
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4092
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4040
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3648
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2368
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3184
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3932
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3156
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3164
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3804
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3976
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2828
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3392
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2196
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3112
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3316
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3500
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3364
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:1888
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3536
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1664
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3560
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3572
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3404
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3100
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3348
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3380
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3520
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3824
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3340
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3428
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3716
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2920
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3588
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2324
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3724
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3660
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3488
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3136
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3672
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3612
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3896
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3452
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3416
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3284
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3352
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3524
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3704
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3756
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3952
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3780
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3692
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3784
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3960
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3712
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3484
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3944
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:1836
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1612
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4076
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:3972
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4052
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1044
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3400
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1756
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4072
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:4068
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3992
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3776
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:1564
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4004
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2412
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        Enumerates processes with tasklist
        
        PID:2280
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:4092
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3592
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1852"
        5⤵
        
        PID:3648
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2368
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3200
- - C:\Users\Admin\AppData\Local\Temp\1014717001\e808c3bb81.exe
    "C:\Users\Admin\AppData\Local\Temp\1014717001\e808c3bb81.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:572
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014717001\e808c3bb81.exe" & rd /s /q "C:\ProgramData\T2DB1DBIMOZU" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:1720
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
- - C:\Users\Admin\AppData\Local\Temp\1014718001\a7538e3b03.exe
    "C:\Users\Admin\AppData\Local\Temp\1014718001\a7538e3b03.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1656
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1352
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2920
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:2120
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2320
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2320.0.992023107\1436023803" -parentBuildID 20221007134813 -prefsHandle 1248 -prefMapHandle 1128 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5eae7b8-497f-4f81-8db7-048b0df4b805} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" 1324 10fd9258 gpu
        6⤵
        
        PID:644
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2320.1.1474327638\1912432619" -parentBuildID 20221007134813 -prefsHandle 1540 -prefMapHandle 1536 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {41800303-5149-494b-8235-32b17f250ce9} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" 1552 e74558 socket
        6⤵
        
        PID:2660
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2320.2.2077607272\1520691753" -childID 1 -isForBrowser -prefsHandle 1904 -prefMapHandle 1868 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 796 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {750c8c10-66ef-4446-a82f-eb24eeba7645} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" 2136 1a4c3058 tab
        6⤵
        
        PID:320
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2320.3.439187687\1324952047" -childID 2 -isForBrowser -prefsHandle 2828 -prefMapHandle 2824 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 796 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b39a69c-6043-479c-95df-791498b5a68c} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" 2848 e62d58 tab
        6⤵
        
        PID:112
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2320.4.653183824\1980834027" -childID 3 -isForBrowser -prefsHandle 3720 -prefMapHandle 3716 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 796 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {473a8994-27f7-4cde-bad9-07a69e65487f} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" 3732 1e995b58 tab
        6⤵
        
        PID:2672
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2320.5.230917077\2049302836" -childID 4 -isForBrowser -prefsHandle 3840 -prefMapHandle 3844 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 796 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcfd7bbb-831f-457a-adc4-e21c5a9d38ff} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" 3828 1e996458 tab
        6⤵
        
        PID:2060
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2320.6.548733797\1501531082" -childID 5 -isForBrowser -prefsHandle 4008 -prefMapHandle 4012 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 796 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1939694e-19f7-4033-a4ab-16f0dd3576b8} 2320 "\\.\pipe\gecko-crash-server-pipe.2320" 4000 1e997c58 tab
        6⤵
        
        PID:2336
- - C:\Users\Admin\AppData\Local\Temp\1014719001\20cb909963.exe
    "C:\Users\Admin\AppData\Local\Temp\1014719001\20cb909963.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\1014720001\49f47e310b.exe
    "C:\Users\Admin\AppData\Local\Temp\1014720001\49f47e310b.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\1014721001\f2bee66f8d.exe
    "C:\Users\Admin\AppData\Local\Temp\1014721001\f2bee66f8d.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3168
- - C:\Users\Admin\AppData\Local\Temp\1014722001\ff901f03ec.exe
    "C:\Users\Admin\AppData\Local\Temp\1014722001\ff901f03ec.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\1014723001\9ef2e23859.exe
    "C:\Users\Admin\AppData\Local\Temp\1014723001\9ef2e23859.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1436
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      PID:3828
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1568
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:3324
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:3348
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:3364
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1632
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3288
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3516
- - C:\Users\Admin\AppData\Local\Temp\1014724001\e413ee25e4.exe
    "C:\Users\Admin\AppData\Local\Temp\1014724001\e413ee25e4.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\1014724001\e413ee25e4.exe
      "C:\Users\Admin\AppData\Local\Temp\1014724001\e413ee25e4.exe"
      4⤵
      Executes dropped EXE
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\1014724001\e413ee25e4.exe
      "C:\Users\Admin\AppData\Local\Temp\1014724001\e413ee25e4.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:3360

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1547832768-253096643-34527571-1799687169776070415-1339231618-765052417-1346195497"
1⤵
PID:3080

C:\Windows\system32\taskeng.exe
taskeng.exe {469CA0CE-5339-4033-BAD4-F6BFA6ABA84A} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:3568
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion