Overview

overview

10

Static

static

3

JaffaCakes...8d.exe

windows7-x64

10

JaffaCakes...8d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2025, 19:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_e9caf32e33bb954fff2c3fadb1e04a8d.exe

  • Size

    1.3MB

  • MD5

    e9caf32e33bb954fff2c3fadb1e04a8d

  • SHA1

    7944adf221b1439bae9338332a270400c03bb77a

  • SHA256

    a84f921834aef064417f4e391e1e29d34b4d0bc04989e9cbbbd64318f8708e91

  • SHA512

    a3308bdcf72d6fc40df8fbe34c0a52da3c16fa228d10a8aa03941333a1015aa17b27c96808dbcdd47ee1d817a1b2f51777f2c2f9b230d8b2a317d7bcfde01412

  • SSDEEP

    24576:y4ktSIvTfZbkXWr+ypPiq1hCnCSyWhrtNSNXjJH4AUgMGs:8YkxQmKyplLS3RtNQCAD2

Score
10/10
darkcomettestdefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

test

C2

romhacker.no-ip.biz:1604

Mutex

DC_MUTEX-D7D35UC

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    ohhRS�*Sjp-*

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 48 IoCs
    persistence
  • Sets file to hidden 1 TTPs 64 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Checks computer location settings 2 TTPs 48 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 48 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 49 IoCs
  • Suspicious use of SetThreadContext 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e9caf32e33bb954fff2c3fadb1e04a8d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e9caf32e33bb954fff2c3fadb1e04a8d.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3932
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e9caf32e33bb954fff2c3fadb1e04a8d.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e9caf32e33bb954fff2c3fadb1e04a8d.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e9caf32e33bb954fff2c3fadb1e04a8d.exe" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3848
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e9caf32e33bb954fff2c3fadb1e04a8d.exe" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:3564
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:4140
      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
        "C:\Windows\system32\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
          "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3472
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2244
            • C:\Windows\SysWOW64\attrib.exe
              attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
              6⤵
              • Sets file to hidden
              • Views/modifies file attributes
              PID:4972
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2200
            • C:\Windows\SysWOW64\attrib.exe
              attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
              6⤵
              • Sets file to hidden
              • Views/modifies file attributes
              PID:3516
          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
            "C:\Windows\system32\MSDCSC\msdcsc.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3872
            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
              "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
              6⤵
              • Modifies WinLogon for persistence
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:3632
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4960
                • C:\Windows\SysWOW64\attrib.exe
                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                  8⤵
                  • Sets file to hidden
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:4036
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                7⤵
                  PID:2144
                  • C:\Windows\SysWOW64\attrib.exe
                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                    8⤵
                    • Sets file to hidden
                    PID:1384
                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:3244
                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                    8⤵
                    • Modifies WinLogon for persistence
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • Modifies registry class
                    PID:464
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:1476
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                        10⤵
                        • Sets file to hidden
                        • Views/modifies file attributes
                        PID:1744
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                      9⤵
                        PID:3668
                        • C:\Windows\SysWOW64\attrib.exe
                          attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                          10⤵
                            PID:4844
                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • Suspicious use of SetWindowsHookEx
                          PID:2664
                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                            10⤵
                            • Modifies WinLogon for persistence
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Modifies registry class
                            PID:2628
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                              11⤵
                                PID:3936
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                  12⤵
                                  • Sets file to hidden
                                  PID:4416
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                11⤵
                                  PID:4636
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                    12⤵
                                    • Sets file to hidden
                                    PID:3208
                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                  11⤵
                                  • Executes dropped EXE
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1072
                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                    12⤵
                                    • Modifies WinLogon for persistence
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    PID:2520
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                      13⤵
                                        PID:2220
                                        • C:\Windows\SysWOW64\attrib.exe
                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                          14⤵
                                          • Drops file in System32 directory
                                          • Views/modifies file attributes
                                          PID:1348
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                        13⤵
                                          PID:4588
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                            14⤵
                                            • Drops file in System32 directory
                                            • Views/modifies file attributes
                                            PID:1216
                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                          13⤵
                                          • Executes dropped EXE
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2744
                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                            14⤵
                                            • Modifies WinLogon for persistence
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Drops file in System32 directory
                                            • Modifies registry class
                                            PID:2268
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                              15⤵
                                                PID:2984
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                  16⤵
                                                  • Views/modifies file attributes
                                                  PID:4152
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                15⤵
                                                  PID:2760
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                    16⤵
                                                    • Sets file to hidden
                                                    • Views/modifies file attributes
                                                    PID:872
                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                  15⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1548
                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                    16⤵
                                                    • Modifies WinLogon for persistence
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    PID:1852
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                      17⤵
                                                        PID:2412
                                                        • C:\Windows\SysWOW64\attrib.exe
                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                          18⤵
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1956
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                        17⤵
                                                          PID:1128
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                            18⤵
                                                            • Sets file to hidden
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4688
                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                          17⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3664
                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                            18⤵
                                                            • Modifies WinLogon for persistence
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Modifies registry class
                                                            PID:1300
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                              19⤵
                                                                PID:4136
                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                  20⤵
                                                                  • Sets file to hidden
                                                                  • Views/modifies file attributes
                                                                  PID:4576
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                19⤵
                                                                  PID:2172
                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                    20⤵
                                                                    • Sets file to hidden
                                                                    • Views/modifies file attributes
                                                                    PID:2824
                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                  19⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Suspicious use of SetThreadContext
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3236
                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                    20⤵
                                                                    • Modifies WinLogon for persistence
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    PID:3300
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                      21⤵
                                                                        PID:1244
                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                          22⤵
                                                                          • Views/modifies file attributes
                                                                          PID:2664
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                        21⤵
                                                                          PID:3916
                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                            22⤵
                                                                            • Sets file to hidden
                                                                            • Views/modifies file attributes
                                                                            PID:1700
                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                          21⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious use of SetThreadContext
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2132
                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                            22⤵
                                                                            • Modifies WinLogon for persistence
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Adds Run key to start application
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            PID:1436
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                              23⤵
                                                                                PID:4732
                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                  24⤵
                                                                                  • Views/modifies file attributes
                                                                                  PID:3832
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                23⤵
                                                                                  PID:4488
                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                    24⤵
                                                                                    • Sets file to hidden
                                                                                    • Drops file in System32 directory
                                                                                    • Views/modifies file attributes
                                                                                    PID:2196
                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                  23⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:872
                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                    24⤵
                                                                                    • Modifies WinLogon for persistence
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Adds Run key to start application
                                                                                    • Drops file in System32 directory
                                                                                    • Modifies registry class
                                                                                    PID:4680
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                      25⤵
                                                                                        PID:3584
                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                          26⤵
                                                                                          • Sets file to hidden
                                                                                          PID:4220
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                        25⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4916
                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                          26⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Views/modifies file attributes
                                                                                          PID:728
                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                        "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                        25⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:632
                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                          "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                          26⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry class
                                                                                          PID:4712
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                            27⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3612
                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                              28⤵
                                                                                              • Sets file to hidden
                                                                                              PID:3092
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                            27⤵
                                                                                              PID:700
                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                28⤵
                                                                                                • Sets file to hidden
                                                                                                • Drops file in System32 directory
                                                                                                • Views/modifies file attributes
                                                                                                PID:3244
                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                              "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                              27⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:4008
                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                28⤵
                                                                                                • Modifies WinLogon for persistence
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                • Modifies registry class
                                                                                                PID:4416
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                  29⤵
                                                                                                    PID:2924
                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                      30⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      PID:1168
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                    29⤵
                                                                                                      PID:2448
                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                        30⤵
                                                                                                        • Views/modifies file attributes
                                                                                                        PID:4752
                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                      "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                      29⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:4876
                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                        "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                        30⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Adds Run key to start application
                                                                                                        • Modifies registry class
                                                                                                        PID:4828
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                          31⤵
                                                                                                            PID:564
                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                              32⤵
                                                                                                              • Sets file to hidden
                                                                                                              PID:964
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                            31⤵
                                                                                                              PID:1012
                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                32⤵
                                                                                                                • Sets file to hidden
                                                                                                                • Views/modifies file attributes
                                                                                                                PID:4452
                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                              "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                              31⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:2784
                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                32⤵
                                                                                                                • Modifies WinLogon for persistence
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Adds Run key to start application
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry class
                                                                                                                PID:2528
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                  33⤵
                                                                                                                    PID:4972
                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                      34⤵
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:4020
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                    33⤵
                                                                                                                      PID:2372
                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                        34⤵
                                                                                                                        • Sets file to hidden
                                                                                                                        PID:2524
                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                      "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                      33⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:1592
                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                        "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                        34⤵
                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Adds Run key to start application
                                                                                                                        • Modifies registry class
                                                                                                                        PID:2664
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                          35⤵
                                                                                                                            PID:5064
                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                              36⤵
                                                                                                                              • Sets file to hidden
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Views/modifies file attributes
                                                                                                                              PID:2520
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                            35⤵
                                                                                                                              PID:4356
                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                36⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Views/modifies file attributes
                                                                                                                                PID:2588
                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                              "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                              35⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4404
                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                36⤵
                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                • Checks computer location settings
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies registry class
                                                                                                                                PID:224
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                  37⤵
                                                                                                                                    PID:3428
                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                      38⤵
                                                                                                                                      • Views/modifies file attributes
                                                                                                                                      PID:1388
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                    37⤵
                                                                                                                                      PID:2708
                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                        38⤵
                                                                                                                                        • Sets file to hidden
                                                                                                                                        • Views/modifies file attributes
                                                                                                                                        PID:1416
                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                      "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                      37⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:3664
                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                        "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                        38⤵
                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:4908
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                          39⤵
                                                                                                                                            PID:864
                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                              40⤵
                                                                                                                                              • Sets file to hidden
                                                                                                                                              • Views/modifies file attributes
                                                                                                                                              PID:4564
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                            39⤵
                                                                                                                                              PID:3488
                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                40⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                PID:1284
                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                              "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                              39⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1588
                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                40⤵
                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies registry class
                                                                                                                                                PID:4692
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                  41⤵
                                                                                                                                                    PID:2780
                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                      42⤵
                                                                                                                                                      • Sets file to hidden
                                                                                                                                                      PID:2080
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                    41⤵
                                                                                                                                                      PID:4468
                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                        42⤵
                                                                                                                                                        • Sets file to hidden
                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                        PID:3408
                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                      "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                      41⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:3576
                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                        "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                        42⤵
                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:4896
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                          43⤵
                                                                                                                                                            PID:1736
                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                              44⤵
                                                                                                                                                              • Sets file to hidden
                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                              PID:852
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                            43⤵
                                                                                                                                                              PID:3364
                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                44⤵
                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                PID:1748
                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                              "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                              43⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:4452
                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                44⤵
                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                PID:3408
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                  45⤵
                                                                                                                                                                    PID:5024
                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                      46⤵
                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                      PID:3304
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                    45⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4032
                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                      46⤵
                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                      PID:3576
                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                    "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                    45⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:4584
                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                      "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                      46⤵
                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:2848
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                        47⤵
                                                                                                                                                                          PID:5052
                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                            48⤵
                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:2868
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                          47⤵
                                                                                                                                                                            PID:1388
                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                              48⤵
                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                              PID:4844
                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                            "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                            47⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:940
                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                              "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                              48⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              PID:1588
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                49⤵
                                                                                                                                                                                  PID:4836
                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                    50⤵
                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                    PID:4256
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                  49⤵
                                                                                                                                                                                    PID:3396
                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                      50⤵
                                                                                                                                                                                        PID:3440
                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                      49⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                      PID:1368
                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                        "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                        50⤵
                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:5072
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                          51⤵
                                                                                                                                                                                            PID:4124
                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                              52⤵
                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                              PID:3692
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                            51⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2624
                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                              52⤵
                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                              PID:744
                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                            51⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:4764
                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                              "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                              52⤵
                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              PID:1816
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                53⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:1904
                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                  PID:3104
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                53⤵
                                                                                                                                                                                                  PID:2152
                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                    PID:744
                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:4420
                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    PID:688
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                          PID:2208
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                          PID:2064
                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:4008
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4708
                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                PID:4396
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2040
                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                PID:4728
                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:4020
                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1928
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                    PID:4852
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                    PID:4764
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                      PID:5124
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                      PID:5212
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                          PID:5272
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                            PID:5360
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:5292
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                            PID:5368
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            PID:5432
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                PID:5488
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                  PID:5572
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                  PID:5516
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                    PID:5592
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:5612
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                    PID:5660
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                          PID:5796
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                          PID:5732
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                          PID:5836
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            PID:5884
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                  PID:5968
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                  PID:6060
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:6108
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                            PID:1628
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                            PID:5208
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                          PID:5168
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            PID:5376
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                PID:5416
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                                  PID:5424
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                    PID:5580
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                        PID:5652
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                          PID:5684
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:5688
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5672
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            PID:5904
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4340
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                  PID:4760
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  PID:1452
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        PID:5156
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                        PID:5372
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                            PID:5176
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                          PID:3328
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5460
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  PID:3764
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                      PID:4296
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                                                                                        PID:4564
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:728
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          PID:1288
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                PID:5596
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                PID:2724
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                  PID:5400
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4020
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                  PID:632
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:5472
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                      PID:5840
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                        PID:5348
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                      PID:5656
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                        PID:6164
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                                                                            PID:6224
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                              PID:6340
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                              PID:6232
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                PID:6328
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                              PID:6396
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                PID:6480
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:6536
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                    PID:6628
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                    PID:6564
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                      PID:6636
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                    PID:6652
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                      PID:6704
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:6760
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                            PID:6840
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:6788
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                            PID:6864
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:6880
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            PID:6928
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                                                PID:6988
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                  PID:7072
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7024
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                    PID:7092
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:7108
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                    PID:7156
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3760
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                          PID:6000
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3052
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                          PID:6408
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                                                              PID:668
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                PID:2028
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6472
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\MSDCSC" +s +h
                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                  PID:3076
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                                PID:6516

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                Filesize

                                                                                                                                                                1.3MB

                                                                                                                                                                MD5

                                                                                                                                                                e9caf32e33bb954fff2c3fadb1e04a8d

                                                                                                                                                                SHA1

                                                                                                                                                                7944adf221b1439bae9338332a270400c03bb77a

                                                                                                                                                                SHA256

                                                                                                                                                                a84f921834aef064417f4e391e1e29d34b4d0bc04989e9cbbbd64318f8708e91

                                                                                                                                                                SHA512

                                                                                                                                                                a3308bdcf72d6fc40df8fbe34c0a52da3c16fa228d10a8aa03941333a1015aa17b27c96808dbcdd47ee1d817a1b2f51777f2c2f9b230d8b2a317d7bcfde01412

                                                                                                                                                                Download Submit

                                                                                                                                                              • memory/464-75-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/464-71-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/632-166-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/872-156-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/940-275-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1072-95-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1072-88-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1300-126-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1368-283-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1436-147-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1548-115-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1588-237-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1592-206-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1852-116-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2132-138-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2132-146-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2268-107-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2472-307-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2520-97-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2628-82-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2628-85-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2664-76-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2664-84-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2744-105-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2784-196-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3236-135-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3244-73-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3300-137-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3300-133-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3404-53-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3472-51-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3472-54-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3576-247-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3632-61-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3632-64-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3664-125-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3664-227-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3664-219-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3872-63-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3932-7-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3932-0-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4008-176-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4020-315-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4404-216-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4420-299-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4452-257-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4540-9-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4540-6-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4540-46-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4540-4-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4540-8-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4540-3-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4584-267-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4680-158-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                732KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4764-291-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4876-186-0x0000000000400000-0x0000000000767000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                3.4MB

                                                                                                                                                                Download