1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	dControl.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3080 created 464	3080	AM_Engine.exe	832
PID 5344 created 1344	5344	AM_Engine.exe	984

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	dControl.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe

Executes dropped EXE 2 IoCs

pid	Process
4824	MpSigStub.exe
544	MpSigStub.exe

Loads dropped DLL 1 IoCs

pid	Process
5400	MsMpEng.exe

System Binary Proxy Execution: wuauclt 1 TTPs 2 IoCs

Abuse Wuauclt to proxy execution of malicious code.

defense_evasion

System Binary Proxy Execution

T1218

pid	Process
464	wuauclt.exe
1344	wuauclt.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dControl.exe

Adds Run key to start application 2 TTPs 48 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 48 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1560	powershell.exe
228	powershell.exe
5912	powershell.exe
5712	powershell.exe
5568	powershell.exe
1456	powershell.exe
120	powershell.exe
6020	powershell.exe
5444	powershell.exe
4824	powershell.exe
1012	powershell.exe
5372	powershell.exe
4600	powershell.exe
3672	powershell.exe
5508	powershell.exe
5860	powershell.exe
3124	powershell.exe
6136	powershell.exe
5472	powershell.exe
5424	powershell.exe
5644	powershell.exe
5272	powershell.exe
5900	powershell.exe
2872	powershell.exe
5188	powershell.exe
2456	powershell.exe
5524	powershell.exe
380	powershell.exe
4608	powershell.exe
5988	powershell.exe
5764	powershell.exe
6016	powershell.exe
1948	powershell.exe
5852	powershell.exe
5620	powershell.exe
5168	powershell.exe
6020	powershell.exe
5936	powershell.exe
3064	powershell.exe
5280	powershell.exe
1580	powershell.exe
3476	powershell.exe
5924	powershell.exe
4916	powershell.exe
628	powershell.exe
6012	powershell.exe
5680	powershell.exe
2340	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe

Modifies Security services 2 TTPs 6 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "0"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	dControl.exe

AutoIT Executable 64 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2276-21-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/732-43-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2896-139-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/472-161-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2896-163-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/252-164-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5340-533-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5508-555-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5508-579-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5340-581-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5224-911-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5280-933-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5224-1225-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5280-1227-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5524-1282-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5524-1595-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5352-1597-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1276-1654-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4444-1675-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1276-1967-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4444-1969-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5580-2031-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/240-2344-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5580-2346-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2968-2422-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5468-2714-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2968-2716-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1784-3075-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5184-3077-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4620-3129-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4620-3439-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4032-3441-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/6056-3493-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/6056-3802-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2236-3804-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/6012-3855-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5816-3877-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/6012-4165-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5816-4167-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5680-4530-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4444-4531-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5644-4582-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1244-4603-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5644-4892-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1244-4894-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5448-4971-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5532-4993-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5448-5282-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5532-5284-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1784-5336-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4364-5377-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1784-5646-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/4364-5648-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/6064-5720-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/6056-6009-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/6064-6011-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5852-6083-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/6124-6372-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/5852-6374-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1388-6425-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2568-6447-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1388-6735-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/2568-6737-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/1156-6810-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MpSigStub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MpSigStub.exe

Drops file in System32 directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MpSigStub.exe	MpSigStub.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2276-21-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/732-43-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2896-139-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/472-161-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2896-163-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/252-164-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5340-533-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5508-555-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5508-579-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5340-581-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5224-911-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5280-933-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5224-1225-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5280-1227-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5524-1282-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5524-1595-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5352-1597-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1276-1654-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4444-1675-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1276-1967-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4444-1969-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5580-2031-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/240-2344-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5580-2346-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2968-2422-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5468-2714-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2968-2716-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1784-3075-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5184-3077-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4620-3129-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4620-3439-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4032-3441-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6056-3493-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6056-3802-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2236-3804-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6012-3855-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5816-3877-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6012-4165-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5816-4167-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5680-4220-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5680-4530-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4444-4531-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5644-4582-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1244-4603-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5644-4892-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1244-4894-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5448-4971-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5532-4993-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5448-5282-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5532-5284-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1784-5336-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4364-5377-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1784-5646-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/4364-5648-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6056-5698-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6064-5720-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6056-6009-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6064-6011-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5852-6083-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/6124-6372-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/5852-6374-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/1388-6425-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2568-6447-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-c04475b4.exe	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-48-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MpSigStub.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MpSigStub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MpSigStub.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MsMpEng.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MpSigStub.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MsMpEng.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MpSigStub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsMpEng.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\DISABLED - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2276	dControl.exe
2276	dControl.exe
2276	dControl.exe
2276	dControl.exe
2276	dControl.exe
2276	dControl.exe
732	dControl.exe
732	dControl.exe
732	dControl.exe
732	dControl.exe
732	dControl.exe
732	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
472	dControl.exe
472	dControl.exe
2896	dControl.exe
2896	dControl.exe
472	dControl.exe
472	dControl.exe
472	dControl.exe
472	dControl.exe
472	dControl.exe
472	dControl.exe
472	dControl.exe
472	dControl.exe
2896	dControl.exe
2896	dControl.exe
2896	dControl.exe
2896	dControl.exe
2896	dControl.exe
2896	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
252	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
252	dControl.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
668	Process not Found
1800	MsMpEng.exe
668	Process not Found
5348	MsMpEng.exe
5152	MsMpEng.exe
668	Process not Found
5776	MsMpEng.exe
668	Process not Found
5824	MsMpEng.exe
668	Process not Found
5952	MsMpEng.exe
668	Process not Found
2656	MsMpEng.exe
668	Process not Found
6084	MsMpEng.exe
668	Process not Found
5912	MsMpEng.exe
668	Process not Found
5228	MsMpEng.exe
668	Process not Found
668	Process not Found
5540	MsMpEng.exe
5580	MsMpEng.exe
668	Process not Found
5820	MsMpEng.exe
668	Process not Found
668	Process not Found
5328	MsMpEng.exe
6128	MsMpEng.exe
668	Process not Found
5680	MsMpEng.exe
668	Process not Found
2664	MsMpEng.exe
668	Process not Found
4760	MsMpEng.exe
668	Process not Found
444	MsMpEng.exe
668	Process not Found
4580	MsMpEng.exe
668	Process not Found
5376	MsMpEng.exe
668	Process not Found
2512	MsMpEng.exe
668	Process not Found
668	Process not Found
3556	MsMpEng.exe
3420	MsMpEng.exe
668	Process not Found
1516	MsMpEng.exe
668	Process not Found
4712	MsMpEng.exe
668	Process not Found
5196	MsMpEng.exe
668	Process not Found
3860	MsMpEng.exe
668	Process not Found
5008	MsMpEng.exe
668	Process not Found
668	Process not Found
1940	MsMpEng.exe
2424	MsMpEng.exe
668	Process not Found
2896	MsMpEng.exe
668	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2276	dControl.exe
Token: SeIncreaseQuotaPrivilege	2276	dControl.exe
Token: 0	2276	dControl.exe
Token: SeDebugPrivilege	732	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	732	dControl.exe
Token: SeIncreaseQuotaPrivilege	732	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	1800	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	1800	MsMpEng.exe
Token: SeTcbPrivilege	1800	MsMpEng.exe
Token: SeSecurityPrivilege	1800	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	1800	MsMpEng.exe
Token: SeLoadDriverPrivilege	1800	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	1800	MsMpEng.exe
Token: SeBackupPrivilege	1800	MsMpEng.exe
Token: SeRestorePrivilege	1800	MsMpEng.exe
Token: SeShutdownPrivilege	1800	MsMpEng.exe
Token: SeDebugPrivilege	1800	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	1800	MsMpEng.exe
Token: SeChangeNotifyPrivilege	1800	MsMpEng.exe
Token: SeImpersonatePrivilege	1800	MsMpEng.exe
Token: SeDebugPrivilege	252	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	252	dControl.exe
Token: SeIncreaseQuotaPrivilege	252	dControl.exe
Token: 0	252	dControl.exe
Token: SeDebugPrivilege	252	dControl.exe
Token: SeDebugPrivilege	1800	MsMpEng.exe
Token: SeAssignPrimaryTokenPrivilege	252	dControl.exe
Token: SeIncreaseQuotaPrivilege	252	dControl.exe
Token: 0	252	dControl.exe
Token: SeBackupPrivilege	1800	MsMpEng.exe
Token: SeRestorePrivilege	1800	MsMpEng.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4600	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeUndockPrivilege	4600	powershell.exe
Token: SeManageVolumePrivilege	4600	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5348	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	5348	MsMpEng.exe
Token: SeTcbPrivilege	5348	MsMpEng.exe
Token: SeSecurityPrivilege	5348	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	5348	MsMpEng.exe
Token: SeLoadDriverPrivilege	5348	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	5348	MsMpEng.exe
Token: SeBackupPrivilege	5348	MsMpEng.exe
Token: SeRestorePrivilege	5348	MsMpEng.exe
Token: SeShutdownPrivilege	5348	MsMpEng.exe
Token: SeDebugPrivilege	5348	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	5348	MsMpEng.exe
Token: SeChangeNotifyPrivilege	5348	MsMpEng.exe
Token: SeImpersonatePrivilege	5348	MsMpEng.exe
Token: SeDebugPrivilege	252	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	252	dControl.exe
Token: SeIncreaseQuotaPrivilege	252	dControl.exe
Token: 0	252	dControl.exe
Token: SeDebugPrivilege	5348	MsMpEng.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
1536	SecurityHealthSystray.exe
1536	SecurityHealthSystray.exe
1536	SecurityHealthSystray.exe
1536	SecurityHealthSystray.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
5916	SecurityHealthSystray.exe
5916	SecurityHealthSystray.exe
5916	SecurityHealthSystray.exe
5916	SecurityHealthSystray.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
1536	SecurityHealthSystray.exe
1536	SecurityHealthSystray.exe
1536	SecurityHealthSystray.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
5916	SecurityHealthSystray.exe
5916	SecurityHealthSystray.exe
5916	SecurityHealthSystray.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
3224	SecurityHealthSystray.exe
3224	SecurityHealthSystray.exe
3224	SecurityHealthSystray.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe
252	dControl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4280	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 472	252	dControl.exe	99
PID 252 wrote to memory of 472	252	dControl.exe	99
PID 252 wrote to memory of 472	252	dControl.exe	99
PID 252 wrote to memory of 5036	252	dControl.exe	100
PID 252 wrote to memory of 5036	252	dControl.exe	100
PID 252 wrote to memory of 2896	252	dControl.exe	103
PID 252 wrote to memory of 2896	252	dControl.exe	103
PID 252 wrote to memory of 2896	252	dControl.exe	103
PID 3852 wrote to memory of 1536	3852	explorer.exe	107
PID 3852 wrote to memory of 1536	3852	explorer.exe	107
PID 1800 wrote to memory of 5916	1800	MsMpEng.exe	116
PID 1800 wrote to memory of 5916	1800	MsMpEng.exe	116
PID 5916 wrote to memory of 5988	5916	MpCmdRun.exe	118
PID 5916 wrote to memory of 5988	5916	MpCmdRun.exe	118
PID 1800 wrote to memory of 6008	1800	MsMpEng.exe	119
PID 1800 wrote to memory of 6008	1800	MsMpEng.exe	119
PID 1800 wrote to memory of 6068	1800	MsMpEng.exe	120
PID 1800 wrote to memory of 6068	1800	MsMpEng.exe	120
PID 252 wrote to memory of 4600	252	dControl.exe	124
PID 252 wrote to memory of 4600	252	dControl.exe	124
PID 252 wrote to memory of 5340	252	dControl.exe	157
PID 252 wrote to memory of 5340	252	dControl.exe	157
PID 252 wrote to memory of 5340	252	dControl.exe	157
PID 252 wrote to memory of 5352	252	dControl.exe	130
PID 252 wrote to memory of 5352	252	dControl.exe	130
PID 252 wrote to memory of 5508	252	dControl.exe	143
PID 252 wrote to memory of 5508	252	dControl.exe	143
PID 252 wrote to memory of 5508	252	dControl.exe	143
PID 5716 wrote to memory of 5916	5716	explorer.exe	136
PID 5716 wrote to memory of 5916	5716	explorer.exe	136
PID 252 wrote to memory of 5764	252	dControl.exe	139
PID 252 wrote to memory of 5764	252	dControl.exe	139
PID 5348 wrote to memory of 5664	5348	MsMpEng.exe	140
PID 5348 wrote to memory of 5664	5348	MsMpEng.exe	140
PID 5664 wrote to memory of 5508	5664	MpCmdRun.exe	143
PID 5664 wrote to memory of 5508	5664	MpCmdRun.exe	143
PID 252 wrote to memory of 5224	252	dControl.exe	146
PID 252 wrote to memory of 5224	252	dControl.exe	146
PID 252 wrote to memory of 5224	252	dControl.exe	146
PID 252 wrote to memory of 5124	252	dControl.exe	147
PID 252 wrote to memory of 5124	252	dControl.exe	147
PID 252 wrote to memory of 5280	252	dControl.exe	150
PID 252 wrote to memory of 5280	252	dControl.exe	150
PID 252 wrote to memory of 5280	252	dControl.exe	150
PID 5152 wrote to memory of 6072	5152	MsMpEng.exe	153
PID 5152 wrote to memory of 6072	5152	MsMpEng.exe	153
PID 6072 wrote to memory of 5404	6072	MpCmdRun.exe	155
PID 6072 wrote to memory of 5404	6072	MpCmdRun.exe	155
PID 5324 wrote to memory of 3224	5324	explorer.exe	156
PID 5324 wrote to memory of 3224	5324	explorer.exe	156
PID 252 wrote to memory of 6020	252	dControl.exe	159
PID 252 wrote to memory of 6020	252	dControl.exe	159
PID 252 wrote to memory of 5524	252	dControl.exe	163
PID 252 wrote to memory of 5524	252	dControl.exe	163
PID 252 wrote to memory of 5524	252	dControl.exe	163
PID 252 wrote to memory of 5912	252	dControl.exe	164
PID 252 wrote to memory of 5912	252	dControl.exe	164
PID 252 wrote to memory of 5352	252	dControl.exe	167
PID 252 wrote to memory of 5352	252	dControl.exe	167
PID 252 wrote to memory of 5352	252	dControl.exe	167
PID 5776 wrote to memory of 5036	5776	MsMpEng.exe	190
PID 5776 wrote to memory of 5036	5776	MsMpEng.exe	190
PID 5036 wrote to memory of 3556	5036	MpCmdRun.exe	172
PID 5036 wrote to memory of 3556	5036	MpCmdRun.exe	172

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dControl.exe
"C:\Users\Admin\AppData\Local\Temp\dControl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276
- C:\Users\Admin\AppData\Local\Temp\dControl.exe
  C:\Users\Admin\AppData\Local\Temp\dControl.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:732
- - C:\Users\Admin\AppData\Local\Temp\dControl.exe
    "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /TI
    3⤵
    - Modifies security service
    - Event Triggered Execution: Image File Execution Options Injection
    - Windows security modification
    - Indicator Removal: Clear Persistence
    - Modifies Security services
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:472
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5036
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3056|
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4600
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5340
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5352
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5740|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5764
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:5224
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5124
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5140|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:6020
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5524
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5912
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5864|
      4⤵
      PID:5352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:628
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:1276
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:6064
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|6048|
      4⤵
      PID:4444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:228
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:64
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:240
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:6124
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|64|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5444
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5468
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4344
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5748|
      4⤵
      System Location Discovery: System Language Discovery
      PID:2968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5188
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:1784
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3224
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|2248|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5936
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:6012
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3340|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:6020
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:6056
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5788
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|1128|
      4⤵
      System Location Discovery: System Language Discovery
      PID:2236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3064
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:472
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:6012
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5528
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|472|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:6016
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:4444
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5532
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5784|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5860
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:5644
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4268
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5588|
      4⤵
      System Location Discovery: System Language Discovery
      PID:1244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5280
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:5448
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5940
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|4064|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5912
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:1784
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5372
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3840|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:2872
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:6056
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:1860
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5444|
      4⤵
      PID:6064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1560
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:6124
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5496
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|1276|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:3124
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:1388
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:1940
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3360|
      4⤵
      PID:2568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:6136
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:5484
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4792
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5836|
      4⤵
      System Location Discovery: System Language Discovery
      PID:1156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1580
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5892
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5452
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|6044|
      4⤵
      PID:5688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3476
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4532
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|6120|
      4⤵
      PID:4832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5472
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:4776
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4284
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:728
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5664|
      4⤵
      System Location Discovery: System Language Discovery
      PID:2116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:2456
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5744
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:1940
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5956|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5924
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender:
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:3864
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5600
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3040
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:404
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|4792|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5424
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4464
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3932
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|4284|
      4⤵
      System Location Discovery: System Language Discovery
      PID:6016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5644
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:4656
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:6008
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|1148|
      4⤵
      System Location Discovery: System Language Discovery
      PID:6104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:4824
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:2548
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4676
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|6032|
      4⤵
      System Location Discovery: System Language Discovery
      PID:1192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1948
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:5884
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5732
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|1520|
      4⤵
      PID:5892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5852
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:4476
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:2916
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|2544|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5524
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4084
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4088
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5852|
      4⤵
      System Location Discovery: System Language Discovery
      PID:6084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5712
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender:
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5788|1324|
      4⤵
      PID:968
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5572
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4464
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|2732|
      4⤵
      System Location Discovery: System Language Discovery
      PID:1800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5272
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:824
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:2872
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5648
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|824|
      4⤵
      System Location Discovery: System Language Discovery
      PID:1704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5620
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5904
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5792|
      4⤵
      PID:1948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:4916
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:3392
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:1936
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5520|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:380
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:3852
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5648
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5364|
      4⤵
      System Location Discovery: System Language Discovery
      PID:2872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:4608
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:2548
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5804
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5912|
      4⤵
      PID:4452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5568
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:1288
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3852
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3996|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5900
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5824
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3476
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:380
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|2592|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3672
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5712
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5744
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3716|
      4⤵
      System Location Discovery: System Language Discovery
      PID:3232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:1456
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5292
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5452|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:1012
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:5816
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4476
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5332|
      4⤵
      PID:3804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:2340
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4832
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:3452
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3080|
      4⤵
      System Location Discovery: System Language Discovery
      PID:2220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5168
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:5764
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:4828
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3564|
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:6012
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:216
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:448
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|4156|
      4⤵
      PID:864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:120
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:5212
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5352
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|5356|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5372
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5988
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3372|
      4⤵
      PID:5780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      PID:5508
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:5372
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:1012
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|6020|
      4⤵
      PID:3628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5988
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      PID:6088
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:5560
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|3960|
      4⤵
      System Location Discovery: System Language Discovery
      PID:4116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5680
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      PID:2824
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:2424
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
      4⤵
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|4628|
      4⤵
      PID:1208

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1264

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5988
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 36099AAF-CA66-4241-2637-A345A20095F0
  2⤵
  PID:6008
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:6068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4572

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4444

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2272

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4032

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4680

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5508

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5916

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5884

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6088

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6132

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of SendNotifyMessage
  PID:3224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5820

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5340

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:404

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:3556

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5748
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5512

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4624

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5752

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5824
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4692
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5036
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:5752
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    PID:4580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1680
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6024

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2180

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1860

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3652

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3912

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5952
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1016
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:6136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4692
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5732

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:2656
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3084
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5912
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4384

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4456

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2288

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5196

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:6084
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5600
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:3996

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1756
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:3532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2632

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5808

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5912
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1148
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5784

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:884
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3880

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2276

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5228
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4696
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5280

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5488
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5192

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5680

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6088

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5548

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5860

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4444

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
PID:5540
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1256
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    PID:884
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:4532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6004
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5664

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6104

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5580
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4580
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:2236

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4600
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6040

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5924

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5480

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5464

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5820
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:456
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5800
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:1944
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:6072

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2896
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5892

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3960

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:380

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6004

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: LoadsDriver
PID:5328
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:6040
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2188
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2656

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6136

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1336

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5088

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
PID:6128
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5328
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5816

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1048
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6068

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: LoadsDriver
PID:5680
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1148
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5532
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5324

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1980

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6004

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:2664
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5568
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1748

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5856
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1700

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1456

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4456

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:4760
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5512
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    PID:5192
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:1496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4268
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:3652

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6052

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5928

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1876

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1944

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5552

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:444
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1096
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:3708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4528
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5184

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3244

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:4580
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1848
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1704
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5860

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3424

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5376
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5716
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5540

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4868
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3320

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2896

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1148

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:448

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5624

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:2512
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1308
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:1244
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:5716
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1268

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1044
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2724

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5212

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1784

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:3556
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5272
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5152

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5624
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4736

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2916

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2552

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:3420
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4576
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:2580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6056
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4260

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2592

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2724

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:1516
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2364
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    PID:3688

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5620
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1464

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2116

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1872

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2580

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:4712
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2580
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:3040

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4828
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5824

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:216

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5196
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3972
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:4704
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:5676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6000
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2664

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1080

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2128

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1960

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:3860
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3104
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    PID:5544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5424
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:1288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:628

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5148

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1180

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:5008
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4624
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:1288
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:5732
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    PID:5572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:824
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:3852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3612

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3804

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4936

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4576

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:1940
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4452
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:3232

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5788
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5416

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3892

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4712

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:2424
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4756
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:2128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5132
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2516

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4260

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:2896
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2116
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1920

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2656
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3372

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1032

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5040

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2040

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5752
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5488
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1324
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6072

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6084

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1860

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
PID:5176
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4660
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5880
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2040

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3960

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4480

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1932

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4916

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2968

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:1704
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3040
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:2664
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:3612
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5712
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1344

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
PID:6080
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3392
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2600
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2512

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5552

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:564

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3084

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5216

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5488
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:6064
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:3668
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:3984
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    PID:2872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5008
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2580

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
PID:220
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3392
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3080
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5256

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1616

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3892

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5292

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:884
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5252
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:2040

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1308
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1560

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2128

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2704

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:3224
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2724
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5472
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:5000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5276
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:6132

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3984

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3708

C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId 031eb37d-5cff-463c-adbf-7ff94cf4d687 /RunHandlerComServer
1⤵
- System Binary Proxy Execution: wuauclt
PID:464
- C:\Windows\SoftwareDistribution\Download\Install\MpSigStub.exe
  "C:\Windows\SoftwareDistribution\Download\Install\MpSigStub.exe" /Store
  2⤵
  - Drops file in System32 directory
  PID:5204
- C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
  "C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  PID:3080
- C:\Windows\system32\MpSigStub.exe
  C:\Windows\system32\MpSigStub.exe /stub 1.1.24010.2001 /payload 1.1.24090.11 /MpWUStub /program C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4824
- C:\Windows\SoftwareDistribution\Download\Install\AM_Base.exe
  "C:\Windows\SoftwareDistribution\Download\Install\AM_Base.exe"
  2⤵
  PID:6080
- C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe
  "C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe" WD /q
  2⤵
  PID:5808

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1388

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3892

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:5400
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4480
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:4156

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6104
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:2116

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4780

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5540

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4820

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5992
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4624
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4780
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:864

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3804

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
PID:5268
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:1260
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:1688

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3984

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5624
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5944

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5424

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:4120
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:4224
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5316
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:3208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:888

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4688

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5764

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1936

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:5536
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2124
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:5188
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
  2⤵
  PID:5880
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:2824

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2232
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1700

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1260

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4424

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4628

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:2560
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:3076
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:4036

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5272
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4444

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3624

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:5600
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:5228
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:4036

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3204
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4444

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1260

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4416

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4736

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
PID:2120
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:864
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:4984
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1244
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4828

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:524

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5892

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1496

C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId 1d164aa8-0a35-4995-9fb5-78c17c8cb30a /RunHandlerComServer
1⤵
- System Binary Proxy Execution: wuauclt
PID:1344
- C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
  "C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  PID:5344
- C:\Windows\system32\MpSigStub.exe
  C:\Windows\system32\MpSigStub.exe /stub 1.1.24010.2001 /payload 1.1.24090.11 /MpWUStub /program C:\Windows\SoftwareDistribution\Download\Install\AM_Engine.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\SoftwareDistribution\Download\Install\AM_Base.exe
  "C:\Windows\SoftwareDistribution\Download\Install\AM_Base.exe"
  2⤵
  PID:3452

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5720

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:4860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

System Binary Proxy Execution

T1218

Credential Access

Discovery

Query Registry

System Information Discovery