c1fc2b876042045053f309285aa138ce7df4ab61e71d589723b13a96738cddf8

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4100	powershell.exe
1476	powershell.exe
2960	powershell.exe
1496	powershell.exe
3096	powershell.exe
3836	powershell.exe
3012	powershell.exe
4008	powershell.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 2 IoCs

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	systemservice92.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	systemservice92.exe

Possible privilege escalation attempt 9 IoCs

exploit

pid	Process
4020	icacls.exe
5100	icacls.exe
1688	icacls.exe
2772	icacls.exe
2944	takeown.exe
1924	icacls.exe
1232	icacls.exe
2120	icacls.exe
3708	icacls.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hb4sbclrdtf8stiz.exe	final.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neyhyfs6whjfrj6u.exe	systemservice92.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neyhyfs6whjfrj6u.exe	systemservice92.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemservice92.exe	systemservice92.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemservice92.exe	systemservice92.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hb4sbclrdtf8stiz.exe	final.exe

Executes dropped EXE 2 IoCs

pid	Process
4312	systemservice92.exe
2568	systemservice92.exe

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Minimal	systemservice92.exe

Loads dropped DLL 64 IoCs

pid	Process
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe
2816	final.exe

Modifies file permissions 1 TTPs 9 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5100	icacls.exe
2944	takeown.exe
2772	icacls.exe
4020	icacls.exe
1232	icacls.exe
1688	icacls.exe
3708	icacls.exe
2120	icacls.exe
1924	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\$Sys-Manager\desktop.ini	final.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
19	discord.com
25	discord.com
26	discord.com
37	discord.com
38	discord.com
17	discord.com
18	discord.com

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	api64.ipify.org
47	api64.ipify.org
48	ip-api.com
27	api.ipify.org
28	api.ipify.org
29	ipinfo.io
30	ipinfo.io

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
2880	tasklist.exe
3572	tasklist.exe
3720	tasklist.exe
2840	tasklist.exe
2820	tasklist.exe
2288	tasklist.exe
3080	tasklist.exe
3144	tasklist.exe
464	tasklist.exe
4456	tasklist.exe
3212	tasklist.exe
3828	tasklist.exe
3920	tasklist.exe
3596	tasklist.exe
1352	tasklist.exe
3636	tasklist.exe
3344	tasklist.exe
1692	tasklist.exe
2188	tasklist.exe
452	tasklist.exe
1972	tasklist.exe
2472	tasklist.exe
1344	tasklist.exe
2612	tasklist.exe
3984	tasklist.exe
2488	tasklist.exe
3452	tasklist.exe
4772	tasklist.exe
3988	tasklist.exe
4340	tasklist.exe
2812	tasklist.exe
1640	tasklist.exe
4392	tasklist.exe
5108	tasklist.exe
2700	tasklist.exe
4204	tasklist.exe
212	tasklist.exe
4064	tasklist.exe
452	tasklist.exe
1564	tasklist.exe
1300	tasklist.exe
4552	tasklist.exe
4104	tasklist.exe
640	tasklist.exe
4908	tasklist.exe
1836	tasklist.exe
4160	tasklist.exe
5012	tasklist.exe
3724	tasklist.exe
3296	tasklist.exe
2820	tasklist.exe
3724	tasklist.exe
4092	tasklist.exe
1836	tasklist.exe
4552	tasklist.exe
3228	tasklist.exe
1148	tasklist.exe
3468	tasklist.exe
2600	tasklist.exe
4100	tasklist.exe
1928	tasklist.exe
2616	tasklist.exe
4660	tasklist.exe
2272	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2560	cmd.exe
4500	cmd.exe
1316	cmd.exe
912	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000024135-1300.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 3 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2628	netsh.exe
636	netsh.exe
2544	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001397c7f967de25740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001397c7f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001397c7f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1397c7f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001397c7f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Delays execution with timeout.exe 64 IoCs

pid	Process
4660	timeout.exe
1708	timeout.exe
3728	timeout.exe
2772	timeout.exe
4104	timeout.exe
4696	timeout.exe
1688	timeout.exe
2880	timeout.exe
4216	timeout.exe
4800	timeout.exe
368	timeout.exe
4528	timeout.exe
1404	timeout.exe
3712	timeout.exe
1368	timeout.exe
1032	timeout.exe
2600	timeout.exe
412	timeout.exe
2188	timeout.exe
1912	timeout.exe
3772	timeout.exe
3572	timeout.exe
4040	timeout.exe
428	timeout.exe
4996	timeout.exe
768	timeout.exe
1792	timeout.exe
2136	timeout.exe
284	timeout.exe
4688	timeout.exe
1252	timeout.exe
3080	timeout.exe
1216	timeout.exe
388	timeout.exe
1060	timeout.exe
3260	timeout.exe
1504	timeout.exe
628	timeout.exe
2352	timeout.exe
1216	timeout.exe
3200	timeout.exe
4064	timeout.exe
2488	timeout.exe
3084	timeout.exe
852	timeout.exe
4176	timeout.exe
2976	timeout.exe
768	timeout.exe
464	timeout.exe
284	timeout.exe
4476	timeout.exe
4040	timeout.exe
1432	timeout.exe
2168	timeout.exe
1912	timeout.exe
3112	timeout.exe
768	timeout.exe
2492	timeout.exe
4408	timeout.exe
2352	timeout.exe
4064	timeout.exe
2288	timeout.exe
2600	timeout.exe
4980	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2408	vssadmin.exe

Kills process with taskkill 1 IoCs

pid	Process
2692	taskkill.exe

Modifies registry key 1 TTPs 14 IoCs

Modify Registry

pid	Process
4696	reg.exe
3572	reg.exe
5096	reg.exe
4992	reg.exe
4640	reg.exe
1936	reg.exe
320	reg.exe
2680	reg.exe
800	reg.exe
3468	reg.exe
3644	reg.exe
512	reg.exe
4324	reg.exe
4872	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4400	schtasks.exe
2436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe
2568	systemservice92.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	final.exe
Token: SeDebugPrivilege	4632	tasklist.exe
Token: SeDebugPrivilege	1564	tasklist.exe
Token: SeDebugPrivilege	1184	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	2568	systemservice92.exe
Token: SeDebugPrivilege	3596	tasklist.exe
Token: SeDebugPrivilege	4232	tasklist.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	1352	tasklist.exe
Token: SeDebugPrivilege	4040	tasklist.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	1300	tasklist.exe
Token: SeDebugPrivilege	1108	tasklist.exe
Token: SeDebugPrivilege	2880	tasklist.exe
Token: SeDebugPrivilege	3572	tasklist.exe
Token: SeBackupPrivilege	4492	vssvc.exe
Token: SeRestorePrivilege	4492	vssvc.exe
Token: SeAuditPrivilege	4492	vssvc.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4908	tasklist.exe
Token: SeDebugPrivilege	3728	tasklist.exe
Token: SeDebugPrivilege	1928	tasklist.exe
Token: SeDebugPrivilege	2264	tasklist.exe
Token: SeDebugPrivilege	1640	tasklist.exe
Token: SeDebugPrivilege	1416	tasklist.exe
Token: SeDebugPrivilege	4632	tasklist.exe
Token: SeDebugPrivilege	3636	tasklist.exe
Token: SeDebugPrivilege	4204	tasklist.exe
Token: SeDebugPrivilege	4332	tasklist.exe
Token: SeDebugPrivilege	2840	tasklist.exe
Token: SeBackupPrivilege	4628	srtasks.exe
Token: SeRestorePrivilege	4628	srtasks.exe
Token: SeSecurityPrivilege	4628	srtasks.exe
Token: SeTakeOwnershipPrivilege	4628	srtasks.exe
Token: SeDebugPrivilege	3344	tasklist.exe
Token: SeBackupPrivilege	4628	srtasks.exe
Token: SeRestorePrivilege	4628	srtasks.exe
Token: SeSecurityPrivilege	4628	srtasks.exe
Token: SeTakeOwnershipPrivilege	4628	srtasks.exe
Token: SeDebugPrivilege	3116	tasklist.exe
Token: SeDebugPrivilege	3228	tasklist.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	1692	tasklist.exe
Token: SeDebugPrivilege	1300	tasklist.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeDebugPrivilege	212	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	1148	tasklist.exe
Token: SeDebugPrivilege	4980	tasklist.exe
Token: SeDebugPrivilege	2252	tasklist.exe
Token: SeDebugPrivilege	2896	tasklist.exe
Token: SeDebugPrivilege	3988	tasklist.exe
Token: SeDebugPrivilege	2188	tasklist.exe
Token: SeDebugPrivilege	3468	tasklist.exe
Token: SeDebugPrivilege	3144	tasklist.exe
Token: SeDebugPrivilege	2820	tasklist.exe
Token: SeDebugPrivilege	4392	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2816	2328	final.exe	82
PID 2328 wrote to memory of 2816	2328	final.exe	82
PID 2816 wrote to memory of 3468	2816	final.exe	84
PID 2816 wrote to memory of 3468	2816	final.exe	84
PID 3468 wrote to memory of 4696	3468	cmd.exe	86
PID 3468 wrote to memory of 4696	3468	cmd.exe	86
PID 2816 wrote to memory of 2268	2816	final.exe	87
PID 2816 wrote to memory of 2268	2816	final.exe	87
PID 2816 wrote to memory of 2684	2816	final.exe	89
PID 2816 wrote to memory of 2684	2816	final.exe	89
PID 2816 wrote to memory of 2560	2816	final.exe	90
PID 2816 wrote to memory of 2560	2816	final.exe	90
PID 2816 wrote to memory of 912	2816	final.exe	91
PID 2816 wrote to memory of 912	2816	final.exe	91
PID 2816 wrote to memory of 1316	2816	final.exe	92
PID 2816 wrote to memory of 1316	2816	final.exe	92
PID 2816 wrote to memory of 4400	2816	final.exe	93
PID 2816 wrote to memory of 4400	2816	final.exe	93
PID 1316 wrote to memory of 3956	1316	cmd.exe	99
PID 1316 wrote to memory of 3956	1316	cmd.exe	99
PID 912 wrote to memory of 1656	912	cmd.exe	100
PID 912 wrote to memory of 1656	912	cmd.exe	100
PID 2268 wrote to memory of 320	2268	cmd.exe	101
PID 2268 wrote to memory of 320	2268	cmd.exe	101
PID 2560 wrote to memory of 3124	2560	cmd.exe	102
PID 2560 wrote to memory of 3124	2560	cmd.exe	102
PID 2684 wrote to memory of 4632	2684	cmd.exe	103
PID 2684 wrote to memory of 4632	2684	cmd.exe	103
PID 2684 wrote to memory of 4204	2684	cmd.exe	104
PID 2684 wrote to memory of 4204	2684	cmd.exe	104
PID 2816 wrote to memory of 2440	2816	final.exe	105
PID 2816 wrote to memory of 2440	2816	final.exe	105
PID 2440 wrote to memory of 3572	2440	cmd.exe	107
PID 2440 wrote to memory of 3572	2440	cmd.exe	107
PID 2816 wrote to memory of 4232	2816	final.exe	108
PID 2816 wrote to memory of 4232	2816	final.exe	108
PID 2816 wrote to memory of 4872	2816	final.exe	109
PID 2816 wrote to memory of 4872	2816	final.exe	109
PID 4232 wrote to memory of 5096	4232	cmd.exe	112
PID 4232 wrote to memory of 5096	4232	cmd.exe	112
PID 4872 wrote to memory of 2120	4872	cmd.exe	114
PID 4872 wrote to memory of 2120	4872	cmd.exe	114
PID 2684 wrote to memory of 4312	2684	cmd.exe	113
PID 2684 wrote to memory of 4312	2684	cmd.exe	113
PID 2816 wrote to memory of 2612	2816	final.exe	115
PID 2816 wrote to memory of 2612	2816	final.exe	115
PID 2684 wrote to memory of 4140	2684	cmd.exe	116
PID 2684 wrote to memory of 4140	2684	cmd.exe	116
PID 2816 wrote to memory of 4676	2816	final.exe	118
PID 2816 wrote to memory of 4676	2816	final.exe	118
PID 2612 wrote to memory of 4992	2612	cmd.exe	120
PID 2612 wrote to memory of 4992	2612	cmd.exe	120
PID 4676 wrote to memory of 2772	4676	cmd.exe	121
PID 4676 wrote to memory of 2772	4676	cmd.exe	121
PID 2816 wrote to memory of 1416	2816	final.exe	122
PID 2816 wrote to memory of 1416	2816	final.exe	122
PID 1416 wrote to memory of 1924	1416	cmd.exe	124
PID 1416 wrote to memory of 1924	1416	cmd.exe	124
PID 2816 wrote to memory of 4500	2816	final.exe	125
PID 2816 wrote to memory of 4500	2816	final.exe	125
PID 4500 wrote to memory of 1212	4500	cmd.exe	127
PID 4500 wrote to memory of 1212	4500	cmd.exe	127
PID 2684 wrote to memory of 1564	2684	cmd.exe	128
PID 2684 wrote to memory of 1564	2684	cmd.exe	128

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStore = "1"	systemservice92.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 4 IoCs

Hidden Files and Directories

T1564.001

pid	Process
3956	attrib.exe
1656	attrib.exe
3124	attrib.exe
1212	attrib.exe

C:\Users\Admin\AppData\Local\Temp\final.exe
"C:\Users\Admin\AppData\Local\Temp\final.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\final.exe
  "C:\Users\Admin\AppData\Local\Temp\final.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /f
      4⤵
      Modifies registry key
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
      4⤵
      Modifies registry key
      PID:320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\$Sys-Manager\systemservice.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4632
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4204
  - - C:\$Sys-Manager\systemservice92.exe
      "C:\$Sys-Manager\systemservice92.exe"
      4⤵
      Executes dropped EXE
      PID:4312
    - - C:\$Sys-Manager\systemservice92.exe
        
        "C:\$Sys-Manager\systemservice92.exe"
        5⤵
        Disables cmd.exe use via registry modification
        Drops file in Drivers directory
        Drops startup file
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2568
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /f"
        6⤵
        
        PID:1928
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /f
        7⤵
        Modifies registry key
        
        PID:3644
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        6⤵
        
        PID:2728
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        7⤵
        Modifies registry key
        
        PID:512
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        6⤵
        
        PID:1640
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        6⤵
        
        PID:512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        6⤵
        Disables cmd.exe use via registry modification
        Modifies registry key
        
        PID:4640
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        6⤵
        
        PID:2664
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:4324
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        6⤵
        
        PID:4836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:636
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:516
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        6⤵
        
        PID:4068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        6⤵
        
        PID:1256
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:1620
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        6⤵
        
        PID:2040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo Y | winget list"
        6⤵
        
        PID:3060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y "
        7⤵
        
        PID:2168
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3348
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        6⤵
        
        PID:3016
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        6⤵
        
        PID:1388
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        6⤵
        
        PID:2700
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3716
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        6⤵
        
        PID:4636
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        6⤵
        
        PID:912
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        6⤵
        
        PID:528
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3764
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        6⤵
        
        PID:2632
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:3592
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:2680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
        6⤵
        
        PID:4144
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
        7⤵
        Modifies registry key
        
        PID:1936
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:4256
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:800
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im firefox.exe"
        6⤵
        
        PID:5076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefox.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users" /grant %username%:F"
        6⤵
        
        PID:2612
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users" /grant Admin:F
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\windowssystem\starter.exe" /sc onlogon /f"
        6⤵
        
        PID:2268
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\windowssystem\starter.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\windowssystem" /deny *S-1-1-0:(D)"
        6⤵
        
        PID:3836
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\windowssystem" /deny *S-1-1-0:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4020
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\windowssystem" /deny *S-1-5-32-544:(D)"
        6⤵
        
        PID:2840
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\windowssystem" /deny *S-1-5-32-544:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\windowssystem" /deny *S-1-5-32-545:(D)"
        6⤵
        
        PID:2876
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\windowssystem" /deny *S-1-5-32-545:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
        6⤵
        
        PID:2820
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\drivers\etc\hosts
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2944
      - C:\Windows\SYSTEM32\setx.exe
        
        setx PATH "C:\$Sys-Manager;C:\Users\Admin\AppData\Local\Temp\_MEI43122\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI23282\pywin32_system32;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;"
        6⤵
        
        PID:4476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:1220
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:4872
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
        6⤵
        
        PID:3816
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        Disables RegEdit via registry modification
        Modifies registry key
        
        PID:3468
      - C:\Windows\SYSTEM32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:2408
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        6⤵
        
        PID:3648
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3708
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Checkpoint-Computer -Description \"Windows Update\" -RestorePointType \"MODIFY_SETTINGS\""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
        6⤵
        
        PID:1792
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2544
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2628
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
        6⤵
        
        PID:1740
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
        6⤵
        
        PID:3060
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show interfaces
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3228
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4140
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1564
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4964
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1032
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1184
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3152
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4716
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2612
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1632
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1404
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3596
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3732
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3772
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4232
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2272
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4176
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4040
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2032
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1708
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1300
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4672
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2168
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1108
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5008
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:692
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2880
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4216
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1060
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3572
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4828
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4688
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4908
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3112
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3940
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3728
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4176
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3572
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1928
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2416
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3188
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2264
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2472
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4872
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1640
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5016
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1416
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2488
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:304
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4632
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3920
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5108
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3636
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2032
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:692
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4204
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:212
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3728
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4332
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:428
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4388
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2840
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3868
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1476
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3344
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3224
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1252
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3116
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5100
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2292
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3228
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3144
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4600
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2820
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1632
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1692
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:308
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4064
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1300
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3200
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4048
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4716
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2700
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:212
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2712
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1912
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4944
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4844
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3112
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1148
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4928
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:464
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4980
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3868
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:452
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2252
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4680
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2772
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2896
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2976
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5056
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3988
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1792
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2692
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2188
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2900
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4564
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3468
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2492
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2248
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3144
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4156
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2600
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2820
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1084
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4800
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1816
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:284
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3212
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:628
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3120
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1836
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3368
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5108
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:228
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4040
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4972
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4456
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4608
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4340
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4512
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1212
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4964
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:428
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2992
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3872
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4476
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:464
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4908
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1740
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:452
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5084
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4680
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4100
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5060
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3260
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3388
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2472
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4660
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2876
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4564
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:512
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2492
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3724
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1424
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3708
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2600
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3292
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2816
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4160
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4800
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1644
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4816
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4408
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3056
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4540
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2488
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4064
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:800
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4484
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3200
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1984
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4052
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2700
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1564
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:212
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3676
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4844
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1912
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4728
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4928
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4848
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2996
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4104
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2080
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3868
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4996
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4696
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2728
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2096
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:876
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3760
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3084
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3076
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2836
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1504
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2272
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2168
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4552
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3060
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4012
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2732
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5076
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5016
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2820
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2600
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1084
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5012
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:5112
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:960
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3828
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2396
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:628
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2880
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4776
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2352
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2488
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:728
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:800
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4688
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2532
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4040
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1972
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3728
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3080
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4472
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1032
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:932
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4964
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1212
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:5068
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4668
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1516
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2088
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3712
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4836
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4324
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:852
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:452
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4996
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4696
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4100
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1908
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1792
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2472
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3012
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3076
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4812
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1196
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2168
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2076
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2648
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2248
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:368
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2616
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3848
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1688
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2428
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:272
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2600
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4092
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3132
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4576
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1416
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2552
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1708
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3828
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2404
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4344
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2880
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1836
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:376
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2488
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4268
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4168
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3200
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4456
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4972
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4176
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4572
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:516
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:640
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2288
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1976
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:412
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4844
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3112
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2356
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4416
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3452
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4780
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4468
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3156
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1500
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4324
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2040
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4692
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2976
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4696
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3736
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4528
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3720
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1336
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3076
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4228
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4812
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2828
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2168
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4552
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1108
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:368
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4772
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2616
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2820
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2428
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:272
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2872
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2812
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3132
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3744
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1816
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2724
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2552
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3920
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1644
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:628
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2132
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4708
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2352
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4852
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:320
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2172
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4868
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1144
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3200
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4204
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4456
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1368
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3080
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4572
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:640
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4020
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2288
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1912
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3276
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:388
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2136
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3376
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2088
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3504
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4468
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2252
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4148
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4104
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4324
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3124
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1552
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1476
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2836
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:992
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2188
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2876
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4228
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2436
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3520
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4884
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4156
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3724
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:1052
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:5016
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1232
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:2600
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1432
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:2872
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4496
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:2776
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4224
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:960
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:284
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3296
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:756
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4628
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1344
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3120
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4064
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4632
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4408
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1824
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4688
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4168
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:4364
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:4992
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:3972
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1368
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4472
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:3080
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      Enumerates processes with tasklist
      PID:640
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4808
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2288
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:1912
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4220
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:388
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq systemservice92.exe"
      4⤵
      PID:3452
  - - C:\Windows\system32\find.exe
      find /I "systemservice92.exe"
      4⤵
      PID:4848
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\$Sys-Manager\systemservice92.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\$Sys-Manager\systemservice92.exe"
      4⤵
      Views/modifies file attributes
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\$Sys-Manager\systemservice.bat""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\$Sys-Manager\systemservice.bat"
      4⤵
      Views/modifies file attributes
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\$Sys-Manager""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\$Sys-Manager"
      4⤵
      Views/modifies file attributes
      PID:3956
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn servicebat /tr C:\$Sys-Manager\systemservice.bat /sc onstart /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:3572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
      4⤵
      Modifies registry key
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\$Sys-Manager" /deny *S-1-1-0:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\$Sys-Manager" /deny *S-1-1-0:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\$Sys-Manager" /deny *S-1-5-32-544:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\$Sys-Manager" /deny *S-1-5-32-544:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\$Sys-Manager" /deny *S-1-5-32-545:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\system32\icacls.exe
      icacls "C:\$Sys-Manager" /deny *S-1-5-32-545:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\$Sys-Manager\desktop.ini""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\$Sys-Manager\desktop.ini"
      4⤵
      Views/modifies file attributes
      PID:1212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry